@bugbug-io/cli@14.16.0
BugBug CLI for test automation, CI workflows, and AI-agent plugin installation
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package discloses runtime telemetry and provides opt-outs, but configures Sentry to collect broad PII, including AI inputs and outputs through supported integrations. That creates a meaningful privacy risk, though the source does not prove an unrelated credential redirect or that this CLI run sends AI content.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI startup when telemetry is enabled, including by default; telemetry can be disabled through documented settings.
Impact
Potential disclosure of sensitive user or AI interaction data to the package's Sentry endpoint; source does not establish that this CLI actually processes such data in a given run.
Mechanism
Sentry initialization sets sendDefaultPii to true and retains default AI-provider integrations, while using a fixed Sentry DSN.
AI rationale
The package discloses runtime telemetry and provides opt-outs, but configures Sentry to collect broad PII, including AI inputs and outputs through supported integrations. That creates a meaningful privacy risk, though the source does not prove an unrelated credential redirect or that this CLI run sends AI content.
Evidence
dist/index.jsdist/chunk-VJEFXB2W.jsREADME.md
Network endpoints1
sentry.bugbug.io
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The CLI initializes Sentry at startup using its configured telemetry setting and a built-in DSN at sentry.bugbug.io.
- Sentry is configured with sendDefaultPii: true; the bundled SDK maps that setting to collection of user info, cookies, HTTP headers and bodies, query parameters, and generative AI inputs and outputs.
- The bundled Sentry defaults include integrations for OpenAI and other AI providers.
- The README documents BUGBUG_TELEMETRY and DO_NOT_TRACK as ways to disable telemetry.
Evidence against
- The package documents a runtime telemetry opt-out.
- BugBug API credentials are sent in an Authorization header through the SDK's configured API base URL.
- I found no source evidence that the prompted BugBug credential is redirected to an unrelated gateway.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flaggeddist/chunk-VJEFXB2W.jsView file
30412setup() {
L30413: diagnosticsChannel.channel("child_process").subscribe((event) => {
L30414: if (isObjectLike(event) && "process" in event) {
High
Child Process
Package source references child process execution.
dist/chunk-VJEFXB2W.jsView on unpkg · L30412•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/chunk-VJEFXB2W.js:
import { createInterface } from "readline";
const readlinePromises = [];
readlinePromises.push(getContextLinesFromFile(file, ranges, cache));
await Promise.all(readlinePromises).catch(() => {
headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`;
"writeFile"
"writeFile"
"writeFileSync"
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/chunk-VJEFXB2W.jsView on unpkg173Cross-file remote execution chain: dist/chunk-VJEFXB2W.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L173: for (let i = 0; i < namespace.length; i++) {
L174: hash = (hash << 5) - hash + namespace.charCodeAt(i);
L175: hash |= 0;
...
L433: let m;
L434: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta...
L435: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?
...
L478: if (!r && typeof process !== "undefined" && "env" in process) {
L479: r = process.env.DEBUG;
L480: }
...
L520: const supportsColor = __require("supports-colo
Findings
1 Critical5 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/chunk-VJEFXB2W.js
HighShelldist/chunk-OM7HXLEF.js
HighCredential Redirect Persistencedist/chunk-VJEFXB2W.js
HighCross File Remote Execution Contextdist/chunk-VJEFXB2W.js
HighSemantic Analysis Limiteddist/getMachineId-bsd-WUTM4C2C.js
MediumDynamic Requirebin/bugbug.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @bugbug-io/cli@14.16.0.
See all versions of @bugbug-io/cli for other recorded verdicts.
- Review the evidence and your use of @bugbug-io/cli@14.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.