@amazon-devices/eslint-plugin-kepler@0.1.16
An ESLint Plugin to suggest Vega App Development best practices
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe formatter sends project and lint-result details through a telemetry client by default, without documenting that reporting in the README. This is undisclosed runtime telemetry, so the package merits a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs ESLint with the package formatter configured, as shown in the README.
Impact
Project identifiers and lint-result details are reported without disclosure in the README; this warrants a warning, but the inspected code does not establish a fixed destination host or credential collection.
Mechanism
After report generation, the formatter sends metrics containing project name, rule IDs, messages, severities, suppressions, and a machine ID through its telemetry client unless disabled by an environment variable.
AI rationale
The formatter sends project and lint-result details through a telemetry client by default, without documenting that reporting in the README. This is undisclosed runtime telemetry, so the package merits a warning rather than a publish block.
Evidence
dist/formatters/default.jsREADME.mdkeplerESLintMetrics.json under KEPLER_ESLINT_OUTPUT_DIR_PATH when file-output mode is enabled
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The formatter collects project name and version plus rule IDs, messages, severities, and suppressions from ESLint results.
- The formatter emits those metrics when it finishes generating its HTML report.
- Telemetry is enabled unless KEPLER_ESLINT_TELEMETRY_DISABLE is set to TRUE; the README does not disclose this reporting.
- The manifest has a prepublishOnly build script, not an install lifecycle hook.
Evidence against
- The README documents the formatter as an explicit ESLint command-line option.
- The code provides environment variables to disable telemetry or write metrics to a local file.
- No fixed network host is identified in the inspected source.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings
Source & flagged code
3 flaggeddist/formatters/default.jsView file
4|| (${a} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(c,s._`+${o}`);case"boolean":return void n.elseIf(s._`${o} === "false" || ${o} === 0 || ${o} === null`).assig...
L5: || ${a} === "boolean" || ${o} === null`).assign(c,s._`[${o}]`)}}n.else(),h(e),n.endIf(),n.if(s._`${c} !== undefined`,()=>{n.assign(o,c),function({gen:e,parentData:t,parentDataPrope...
L6: missingProperty: ${o},
High
Child Process
Package source references child process execution.
dist/formatters/default.jsView on unpkg · L41Cross-file remote execution chain: dist/formatters/default.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L1: /*! For license information please see default.js.LICENSE.txt */
L2: (()=>{var __webpack_modules__={113:e=>{"use strict";const t={};function r(e,r,n){n||(n=Error);class o extends n{constructor(e,t,n){super(function(e,t,n){return"string"==typeof r?r:...
L3: || (${a} == "string" && ${o} && ${o} == +${o})`).assign(c,s._`+${o}`);case"integer":return void n.elseIf(s._`${a} === "boolean" || ${o} === null
L4: || (${a} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(c,s._`+${o}`);case"boolean":return void n.elseIf(s._`${o} === "false" || ${o} === 0 || ${o} === null`).assig...
L5: || ${a} === "boolean" || ${o} === null`).assign(c,s._`[${o
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
Findings
2 High3 Medium7 Low
HighChild Processdist/formatters/default.js
HighCross File Remote Execution Contextdist/formatters/default.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/formatters/default.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @amazon-devices/eslint-plugin-kepler@0.1.16.
See all versions of @amazon-devices/eslint-plugin-kepler for other recorded verdicts.
- Review the evidence and your use of @amazon-devices/eslint-plugin-kepler@0.1.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.