registry / @bugbug-io/cli / 14.10.0
@bugbug-io/cli@14.10.0
BugBug CLI for test automation, CI workflows, and AI-agent plugin installation
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe hinted credential redirection was not confirmed: the SDK defaults to BugBug's API and sends credentials to its configured service URL. Telemetry is opt-out and its event properties are filtered.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI startup, authenticated BugBug commands, or explicitly chosen login and configuration flows.
Impact
Expected BugBug API operations and opt-out runtime telemetry.
Mechanism
The SDK sends the configured BugBug token to its configured API URL; documented telemetry opt-outs are available.
AI rationale
The hinted credential redirection was not confirmed: the SDK defaults to BugBug's API and sends credentials to its configured service URL. Telemetry is opt-out and its event properties are filtered.
Evidence
~/.bugbug/config.yaml./bugbug.yaml
Network endpoints4
app.bugbug.iomcp.bugbug.iodocs.bugbug.iosentry.bugbug.io
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares `prepublishOnly` to build the package, with no install lifecycle hook.
- The CLI describes its token option as a BugBug API token, and the navigator asks users to paste a project or organization API token.
- The SDK defaults to `https://app.bugbug.io/api/v2`; API URL overrides come from environment or user configuration.
- The SDK attaches the configured token to authenticated requests to its configured API URL.
- Telemetry sends filtered event properties to the configured API URL, and the README documents `--disable-telemetry`, `BUGBUG_TELEMETRY`, and `DO_NOT_TRACK` opt-outs.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
7 flaggeddist/chunk-OM7HXLEF.jsView file
6// ../../node_modules/@[redacted]-id/execAsync.js
L7: import * as child_process from "child_process";
L8: import * as util from "util";
High
Child Process
Package source references child process execution.
dist/chunk-OM7HXLEF.jsView on unpkg · L65L6: // ../../node_modules/@[redacted]-id/execAsync.js
L7: import * as child_process from "child_process";
High
bin/bugbug.mjsView file
3L4: globalThis.require = createRequire(import.meta.url);
L5:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/bugbug.mjsView on unpkg · L3Findings
1 Critical5 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/chunk-OM7HXLEF.js
HighShelldist/chunk-OM7HXLEF.js
HighCredential Redirect Persistencedist/chunk-Q2VWHHIF.js
HighCross File Remote Execution Contextdist/chunk-Q2VWHHIF.js
HighSemantic Analysis Limiteddist/getMachineId-bsd-WUTM4C2C.js
MediumDynamic Requirebin/bugbug.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @bugbug-io/cli@14.10.0.
See all versions of @bugbug-io/cli for other recorded verdicts.
- Review the evidence and your use of @bugbug-io/cli@14.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.