registry / @ciandt-flow/flow-ai-obs / 0.12.0

@ciandt-flow/flow-ai-obs@0.12.0

Claude Code hooks for Langfuse OTLP tracing — cross-platform

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall executes setup that modifies Claude Code's settings and installs command hooks without an explicit user setup command. Those hooks capture Claude session inputs for telemetry.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

Foreign AI-agent settings are modified and prompt/session data becomes available to package telemetry handlers.

Mechanism

unconsented Claude Code hook registration via postinstall

Policy narrative

Installing the package runs dist/setup.js. Its startup calls the configuration writer before checking whether credentials exist, then creates or updates ~/.claude/settings.json and adds hooks for prompt, tool, and stop events. The installed handler records submitted prompts and session context for the package's telemetry flow. This is an unprompted install-time mutation of the foreign Claude Code control surface.

Rationale

The package has a concrete, manifest-reachable postinstall chain that silently registers hooks in Claude Code settings. Package-aligned telemetry does not remove the unconsented foreign AI-agent configuration mutation.

Evidence

package.jsondist/setup.jsdist/index.js~/.claude/settings.json~/.claude/settings.json.bkp~/.claude/settings.json.lock

Network endpoints1

flow.ciandt.com

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

postinstall directly executes dist/setup.js.
Setup invokes configuration before checking credentials.
Setup writes ~/.claude/settings.json and registers four flow-ai-obs hooks.
Hook handler captures submitted prompt and session context.

Evidence against

Default telemetry host is package-aligned flow.ciandt.com.
README describes an explicit init command, though installation already mutates Claude settings.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 3 file(s), 126 KB of source, external domains: flow.ciandt.com, github.com, registry.npmjs.org

Source & flagged code

10 flagged

package.jsonView file

Lines 1-38json

2 "name": "@ciandt-flow/flow-ai-obs",

3 "version": "0.12.0",

4 "description": "Claude Code hooks for Langfuse OTLP tracing — cross-platform",

5 "main": "dist/index.js",

6 "bin": {

7 "flow-ai-obs": "dist/cli.js",

8 "flow-ai-obs-setup": "dist/setup.js"

9 },

10 "scripts": {

11 "build": "tsup",

12 "test": "jest",

13 "typecheck": "tsc --noEmit",

14 "lint": "eslint src bin scripts",

15 "format": "prettier --write \"src/**/*.ts\" \"bin/**/*.ts\" \"scripts/**/*.ts\"",

16 "format:check": "prettier --check \"src/**/*.ts\" \"bin/**/*.ts\" \"scripts/**/*.ts\"",

17 "security-scan": "trufflehog filesystem src/ --fail --no-update --exclude-paths .trufflehogignore",

18 "postinstall": "node -e \"require('fs').existsSync('dist/setup.js') && require('child_process').execFileSync(process.execPath, ['dist/setup.js'], {stdio:'inherit'})\"",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "prepublishOnly": "npm run security-scan && npm run build",

20 "release:npm": "changeset publish",

21 "changeset": "changeset",

22 "version-packages": "changeset version",

23 "install:hooks": "node dist/cli.js install",

24 "auth:login": "node dist/cli.js auth login",

25 "auth:logout": "node dist/cli.js auth logout",

26 "auth:status": "node dist/cli.js auth status",

27 "smoke": "bash scripts/smoke-test.sh",

28 "smoke:debug": "bash scripts/smoke-test.sh --debug",

29 "smoke:send": "bash scripts/smoke-test.sh --send --allow-http --debug",

30 "regression": "jest --config jest.regression.config.js --forceExit",

31 "regression:update": "UPDATE_GOLDEN=1 jest --config jest.regression.config.js --forceExit"

32 },

33 "files": [

34 "dist/",

35 "README.md",

36 "LICENSE.md"

37 ],

38 "keywords": [

dist/index.jsView file

Lines 1-16javascript

1'use strict';var child_process=require('child_process'),util=require('util'),R=require('fs'),M=require('path'),me=require(

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2'use strict';var ve=require('readline/promises'),ls=require('https'),k=require('fs'),ht=require('os'),Pt=require(

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "require('fs').existsSync('dist/setup.js') && require('child_process').execFileSync(process.execPath, ['dist/setup.js'], {stdio:'inherit'})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "require('fs').existsSync('dist/setup.js') && require('child_process').execFileSync(process.execPath, ['dist/setup.js'], {stdio:'inherit'})"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

1'use strict';var child_process=require('child_process'),util=require('util'),R=require('fs'),M=require('path'),me=require('os'),Je=require('https'),Ke=require('http'),crypto=requir... L2: `;try{R.writeFileSync(We,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';var child_process=require('child_process'),util=require('util'),R=require('fs'),M=require('path'),me=require('os'),Je=require('https'),Ke=require('http'),crypto=requir... L2: `;try{R.writeFileSync(We,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: 'use strict';var ve=require('readline/promises'),ls=require('https'),k=require('fs'),ht=require('os'),Pt=require('path'),child_process=require('child_process'),vs=require('http'),u... `);}catch(s){throw n.close(),s}if(n.close(),e!==void 0)return e;throw new Error("Too many invalid attempts for yes/no prompt")}async function _n(t,e){let n=ve__namespace.createInte... `);let n=child_process.spawn("npm",["install","-g",`${e}@${t}`],{detached:true,stdio:"ignore",shell:process.platform==="win32",windowsHide:true});n.on("error",()=>{}),n.unref();}as... `);}n();}}r.on("close",(s,a)=>i(s===0,a??void 0)),r.on("error",s=>i(false,s.co

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

1#!/usr/bin/env node L2: 'use strict';var ve=require('readline/promises'),ls=require('https'),k=require('fs'),ht=require('os'),Pt=require('path'),child_process=require('child_process'),vs=require('http'),u... L3: `);}catch(s){throw n.close(),s}if(n.close(),e!==void 0)return e;throw new Error("Too many invalid attempts for yes/no prompt")}async function _n(t,e){let n=ve__namespace.createInte... L4: \u256D${s}\u256E ... L11: L12: `);let n=child_process.spawn("npm",["install","-g",`${e}@${t}`],{detached:true,stdio:"ignore",shell:process.platform==="win32",windowsHide:true});n.on("error",()=>{}),n.unref();}as... L13: \u256D${u}\u256E ... L30: `)+` L31: `),1}var ue=g(()=>{"use strict";ut();});function Pn(){if(process.platform==="linux"&&process.getuid?.()===0&&process.env.SUDO_USER){let e=c

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

1Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: 'use strict';var ve=require('readline/promises'),ls=require('https'),k=require('fs'),ht=require('os'),Pt=require('path'),child_process=require('child_process'),vs=require('http'),u... L3: `);}catch(s){throw n.close(),s}if(n.close(),e!==void 0)return e;throw new Error("Too many invalid attempts for yes/no prompt")}async function _n(t,e){let n=ve__namespace.createInte... L4: \u256D${s}\u256E ... L11: L12: `);let n=child_process.spawn("npm",["install","-g",`${e}@${t}`],{detached:true,stdio:"ignore",shell:process.platform==="win32",windowsHide:true});n.on("error",()=>{}),n.unref();}as... L13: \u256D${u}\u256E ... L30: `)+` L31: `),1}var u

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L1

19`),T(h));}let d=setTimeout(()=>S(false),e);A.once("line",h=>S(h.trim().toLowerCase()==="y")),A.once("close",()=>S(false));})}async function kn(t){let e=x().name;return process.stde... L20: `),new Promise(n=>{let r=child_process.spawn("npm",["install","-g",`${e}@${t}`],{stdio:"inherit",shell:process.platform==="win32"}),o=false;function i(s,a){if(!o){if(o=true,s)proce... L21: ... L28: L29: `)+P(` npm install -g @ciandt-flow/flow-ai-obs L30: `)+`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L19

Findings

9 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCredential Redirect Persistencedist/cli.js

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighRuntime Package Installdist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License