@apso/cli@0.43.2
Apso CLI
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged network and execution behavior is tied to explicit project checks and the CLI’s disclosed, opt-out runtime telemetry. No install-time collection, credential exfiltration, or unrelated account action was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Telemetry runs when a CLI command starts; smoke tests run when the user invokes `apso test smoke`.
Impact
No malicious impact identified. Smoke tests create and delete test rows as described by the command; telemetry reports usage and Apso workspace context.
Mechanism
The verifier checks the project server on 127.0.0.1 and may connect to the database configured by the user. Runtime telemetry has a first-run notice and opt-out controls.
AI rationale
The flagged network and execution behavior is tied to explicit project checks and the CLI’s disclosed, opt-out runtime telemetry. No install-time collection, credential exfiltration, or unrelated account action was found.
Network endpoints4
127.0.0.1us.i.posthog.como4509208616435714.ingest.us.sentry.ioDATABASE_URL hostname (user-configured)
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the normal Apso CLI entry point and declares no install lifecycle script.
- The verifier sends requests to a server bound to 127.0.0.1 for health checks and CRUD smoke tests.
- Smoke tests run from the explicit `apso test smoke` command; the CLI description says they create and delete test rows.
- Runtime telemetry is disclosed, can be disabled, and reports CLI and platform fields plus Apso workspace context.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggeddist/lib/upgrade.jsView file
12const tslib_1 = require("tslib");
L13: const child_process_1 = require("child_process");
L14: const inquirer_1 = tslib_1.__importDefault(require("inquirer"));
High
Child Process
Package source references child process execution.
dist/lib/upgrade.jsView on unpkg · L12dist/lib/verify/index.jsView file
10const tslib_1 = require("tslib");
L11: const child_process_1 = require("child_process");
L12: const fs = tslib_1.__importStar(require("fs"));
L13: const http = tslib_1.__importStar(require("http"));
L14: const net = tslib_1.__importStar(require("net"));
...
L27: return new Promise((resolve) => {
L28: const p = (0, child_process_1.spawn)(cmd, args, { cwd, env: { ...process.env, ...env } });
L29: let output = "";
L30: p.stdout.on("data", (d) => {
L31: output += d;
...
L230: });
L231: res.on("end", () => { var _a; return resolve({ status: (_a = res.statusCode) !== null && _a !== void 0 ? _a : 0, body: text }); });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/lib/verify/index.jsView on unpkg · L10Findings
2 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/lib/verify/index.js
CriticalPrevious Version Dangerous Deltadist/commands/dev.js
HighChild Processdist/lib/upgrade.js
HighShell
HighSame File Env Network Executiondist/lib/verify/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @apso/cli@0.43.2.
See all versions of @apso/cli for other recorded verdicts.
- Review the evidence and your use of @apso/cli@0.43.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.