@auspex-ai/cli
Auspex command-line tool
This report shows the evidence for @auspex-ai/cli@0.4.0. 0 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package does not show install-time or automatic credential theft. Its explicit self-host setup command sends identifying deployment details to the Auspex server as documented, opt-out usage reporting; that identifying telemetry merits a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running auspex selfhost up.
Impact
The Auspex server receives identifying information about the user's organization and deployment.
Mechanism
The command posts deployment metadata, including a service account email and deployment URL, to /api/cli/selfhost-register on the saved Auspex server. Reporting can be disabled with AUSPEX_USAGE_REPORTING=off.
AI rationale
The package does not show install-time or automatic credential theft. Its explicit self-host setup command sends identifying deployment details to the Auspex server as documented, opt-out usage reporting; that identifying telemetry merits a warning.
Evidence
dist/bin.mjsCHANGELOG.mddist/selfhost-module/main.tf
Network endpoints5
credentials.server (defaults to https://app.auspex.blue)accounts.google.comoauth2.googleapis.comapi.slack.comdocs.auspex.blue
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- During selfhost up, the CLI reports the image version, organization name and ID, batch service account email, and deployment URL to the Auspex registration endpoint.
- The registration request uses the saved Auspex server and sends the saved Auspex token as a bearer token.
- The changelog describes the registration data and documents AUSPEX_USAGE_REPORTING=off as an opt-out.
- Slack secrets are mapped into the deployment's Secret Manager environment only when Slack is enabled.
Evidence against
- The manifest declares a CLI executable and no install, preinstall, or postinstall hook.
- Registration is reached through the explicit selfhost up command.
- The registration behavior is documented and can be disabled.
- The Slack secret mapping is part of configuring the user's self-hosted deployment; no forwarding of those Slack secrets to an unrelated host was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggeddist/bin.mjsView file
5import { createHash, randomBytes } from "node:crypto";
L6: import { execFile, spawn } from "node:child_process";
L7: import { createServer } from "node:http";
L8: import { homedir } from "node:os";
...
L15: const xdg = deps.env.XDG_CONFIG_HOME?.trim();
L16: const base = xdg?.startsWith("/") ? xdg : join(deps.homedir(), ".config");
L17: return join(base, "auspex", name);
...
L47: try {
L48: const v = JSON.parse(raw);
L49: return isCredentials(v) ? v : null;
...
L98: },
L99: body: JSON.stringify(body)
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/bin.mjsView on unpkg · L55Trigger-reachable chain: manifest.bin -> dist/bin.mjs
L5: import { createHash, randomBytes } from "node:crypto";
L6: import { execFile, spawn } from "node:child_process";
L7: import { createServer } from "node:http";
L8: import { homedir } from "node:os";
...
L15: const xdg = deps.env.XDG_CONFIG_HOME?.trim();
L16: const base = xdg?.startsWith("/") ? xdg : join(deps.homedir(), ".config");
L17: return join(base, "auspex", name);
...
L47: try {
L48: const v = JSON.parse(raw);
L49: return isCredentials(v) ? v : null;
...
L98: },
L99: body: JSON.stringify(body)
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/bin.mjsView on unpkg · L5Findings
2 Critical3 High3 Medium4 Low
CriticalCredential Exfiltrationdist/bin.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/bin.mjs
HighChild Processdist/bin.mjs
HighCommand Output Exfiltrationdist/bin.mjs
HighTrigger Reachable Credential Exfiltrationdist/bin.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @auspex-ai/cli@0.4.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @auspex-ai/cli@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.