registry / @ciandt-flow/flow-ai-obs / 0.8.1

@ciandt-flow/flow-ai-obs@0.8.1

Claude Code hooks for Langfuse OTLP tracing — cross-platform

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 124 KB of source, external domains: flow.ciandt.com, github.com, nodejs.org, registry.npmjs.org

Source & flagged code

8 flagged

package.jsonView file

Lines 1-38json

2 "name": "@ciandt-flow/flow-ai-obs",

3 "version": "0.8.1",

4 "description": "Claude Code hooks for Langfuse OTLP tracing — cross-platform",

5 "main": "dist/index.js",

6 "bin": {

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "require('fs').existsSync('dist/setup.js') && require('child_process').execFileSync(process.execPath, ['dist/setup.js'], {stdio:'inherit'})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "require('fs').existsSync('dist/setup.js') && require('child_process').execFileSync(process.execPath, ['dist/setup.js'], {stdio:'inherit'})"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

1'use strict';var child_process=require('child_process'),util=require('util'),I=require('fs'),x=require('path'),fe=require('os'),Je=require('https'),je=require('http'),crypto=requir... L2: `;try{I.writeFileSync(We,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1'use strict';var child_process=require('child_process'),util=require('util'),I=require('fs'),x=require('path'),fe=require('os'),Je=require('https'),je=require('http'),crypto=requir... L2: `;try{I.writeFileSync(We,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';var child_process=require('child_process'),util=require('util'),I=require('fs'),x=require('path'),fe=require('os'),Je=require('https'),je=require('http'),crypto=requir... L2: `;try{I.writeFileSync(We,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

dist/cli.jsView file

1#!/usr/bin/env node L2: 'use strict';var Pe=require('readline/promises'),ms=require('https'),g=require('fs'),lt=require('os'),It=require('path'),child_process=require('child_process'),Ps=require('http'),u... L3: `);}catch(i){throw r.close(),i}if(r.close(),e!==void 0)return e;throw new Error("Too many invalid attempts for yes/no prompt")}async function Sr(t,e){let r=Pe__namespace.createInte... L4: \u256D${i}\u256E ... L27: `;try{g.writeFileSync(Rs,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message} L28: `);}}var Rs,D=m(()=>{"use strict";O();Rs=It.join(lt.tmpdir(),vr);});function Cs(t){if(!bs.test(t))throw new Error(`Invalid tenant value: "${t}". Tenant must be lowercase alphanumer... L29: `+L(` \u2717 flow-ai-obs is not supported in a sudo context. ... L32: `)+` L33: `),1}var Mt=m(()=>{"use strict";it();});function Ir(){if(process.platform==="linux"&&process.getuid?.()===0&&process.env.SUDO_USER){let e=child_process.spawnSync("getent",["passwd"... L34: `,{encoding:"utf8",mode:384});try{g__namespace.chmodSync(t,384);}catch{}}finally{fe(e);}return {settingsPath:t,preserved:r}}function Rt(t){try{let e=g__namespace.readFileSync(v(),"... ... L36: `,{enc

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

1Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: 'use strict';var Pe=require('readline/promises'),ms=require('https'),g=require('fs'),lt=require('os'),It=require('path'),child_process=require('child_process'),Ps=require('http'),u... L3: `);}catch(i){throw r.close(),i}if(r.close(),e!==void 0)return e;throw new Error("Too many invalid attempts for yes/no prompt")}async function Sr(t,e){let r=Pe__namespace.createInte... L4: \u256D${i}\u256E ... L27: `;try{g.writeFileSync(Rs,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message} L28: `);}}var Rs,D=m(()=>{"use strict";O();Rs=It.join(lt.tmpdir(),vr);});function Cs(t){if(!bs.test(t))throw new Error(`Invalid tenant value: "${t}". Tenant must be lowercase alphanumer... L29: `+L(` \u2717 flow-ai-obs is not supported in a sudo context. ... L32: `)+` L33: `),1}var Mt=m(()=>{"use strict";it();});function Ir(){if(process.platform==="linux"&&process.getuid?.()===0&&process.env.SUDO_USER){let e=child_process.spawnSync("getent",["passwd"... L34: `,{encoding:"utf8",mode:384});try{g__namespace.chmodSync(t,384);}catc…

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L1

19`),d(_));}let A=setTimeout(()=>T(false),e);h.once("line",_=>T(_.trim().toLowerCase()==="y")),h.once("close",()=>T(false));})}async function Ss(t){let e=C().name;return process.stde... L20: `),new Promise(r=>{let n=child_process.spawn("npm",["install","-g",`${e}@${t}`],{stdio:"inherit"});n.on("close",s=>{s!==0?process.stderr.write(` \u2717 Update failed \u2014 contin... L21: ... L30: L31: `)+R(` npm install -g @ciandt-flow/flow-ai-obs L32: `)+`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L19

Findings

7 High4 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighRuntime Package Installdist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

dist/index.jsView file

Lines 1-16javascript

1'use strict';var child_process=require('child_process'),util=require('util'),I=require('fs'),x=require('path'),fe=require('os'),Je=require('https'),je=require('http'),crypto=require('crypto');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var I__default=/*#__PURE__*/_interopDefault(I);var x__default=/*#__PURE__*/_interopDefault(x);var fe__default=/*#__PURE__*/_interopDefault(fe);var Je__default=/*#__PURE__*/_interopDefault(Je);var je__default=/*#__PURE__*/_interopDefault(je);var Re=Object.defineProperty;var et=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:( ...

2`;try{I.writeFileSync(We,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

3`);}}var b=class extends Error{constructor(e){super(e),this.name="AuthError";}},Ke=/^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$|^[a-z0-9]$/;function qe(t){if(!Ke.test(t))throw new Error(`Invalid tenant value: "${t}". Tenant must be lowercase alphanumeric and hyphens (1-64 chars).`)}var Kt={INVALID_CLIENT_SECRET:"Invalid Client Secret \u2014 check the value and try again",INVALID_CLIENT_ID:"Invalid Client ID \u2014 check the value and try again",INVALID_TENANT:"Invalid Tenant \u2014 check the value and try again",TENANT_NOT_FOUND:"Tenant not found \u2014 verify the tenant identifier"};function ze(t,e){le ...

4`)[0].slice(0,e).trim()}function Lt(){return new Promise(t=>{let e="";process.stdin.setEncoding("utf8"),process.stdin.on("data",r=>{e+=r;}),process.stdin.on("end",()=>{try{t(JSON.parse(e));}catch{t({});}});})}

5`);for(let r=e.length-1;r>=0;r--)try{let n=JSON.parse(e[r]);if(n.type==="user"&&n.uuid)return n.uuid}catch{}}catch{}return null}function Pt(t){if(!t||!I.existsSync(t))return null;try{let e=I.readFileSync(t,"utf8").trimEnd().split(`

6`),r=[],n=0,o=0;for(let s=e.length-1;s>=0;s--)try{let i=JSON.parse(e[s]);if(i.type==="user")break;if(i.type==="assistant"){let c=(i.message?.content??[]).filter(S=>S.type==="text").map(S=>S.text??"").join("");c&&r.unshift(c);let p=i.message?.usage??{};n+=(p.input_tokens??0)+(p.cache_read_input_tokens??0)+(p.cache_creation_input_tokens??0),o+=p.output_tokens??0;}}catch{}return !r.length&&n===0?null:{text:r.join(`

8`),inputTokens:n,outputTokens:o}}catch{}return null}var Tr=new Set([".venv","__pycache__",".git","node_modules"]),Er=new Set([".pyc",".pyo"]),hr=new Set(["SKILL.md",".DS_Store",".gitignore"]);function se(t){return t.replace(":","/")}function lt(t,e){if(!t)return null;let r=se(t),n=[x.join(fe.homedir(),".claude","skills",r,"SKILL.md"),x.join(e??"",".claude","skills",r,"SKILL.md")];for(let o of n)if(I.existsSync(o))try{return I.readFileSync(o,"utf8")}catch{}return null}function oe(t){return t.split(`

9`)[0].match(/^\/([a-z][a-z0-9-]*(?::[a-z][a-z0-9-]*)?)(?:\s.*)?$/i)?.[1]??null}var yr=new Set(["Read","Write","Edit","MultiEdit","Bash","Glob","Grep","TodoWrite","WebFetch","WebSearch","Agent","Task"]);function ie(t){return !!t.slashSkill||t.toolCalls.some(n=>n.tool==="Skill")?t.toolCalls.some(n=>n.tool==="Skill"&&!n.synthetic||yr.has(n.tool))?"complete":"prerequisite_required":null}function ut(t,e){if(!t)return null;let r=se(t),n=[x.join(fe.homedir(),".claude","skills",r),x.join(e??"",".claude","skills",r)],o=null;for(let l of n)if(I.existsSync(x.join(l,"SKILL.md"))){o=l;break}if(!o)return nu ...

10`);return}let n=!!(await v()).authError,o=t.session_id||"unknown",s=t.prompt||"",i=t.cwd||"",l=ee(t.transcript_path)||It(),c=oe

11`,{flag:"a",encoding:"utf8",mode:384}),a("sendTraces:dump",`request appendada em ${le}`);}catch(i){a("sendTraces:dump",`falha ao salvar: ${i.message}`);}}function Cr(t){let e=new URL(t),r=new URL(G().GATEWAY_HEALTH);return r.hostname=e.hostname,r.port=e.port,r.protocol=e.protocol,r}function pe(t,e){return new Promise((r,n)=>{let o=t._isSSL?Je__default.default:je__default.default;t.headers=Object.assign({},t.headers,{Connection:"close"});let s=o.request(t,i=>{let l=[];i.on("data",c=>l.push(c)),i.on("end",()=>r({statusCode:i.statusCode??0,body:l.join("")}));});s.setTimeout(1e4,()=>{s.destroy(new ...

12${y}

13${r}`},{re:/\b(AKIA[0-9A-Z]{16})\b/g,replace:()=>`AKIA${y}`},{re:/(aws_secret_access_key\s*[=:]\s*)([A-Za-z0-9/+]{40})/

14`)),E=p?.inputTokens??0,h=p?.outputTokens??0,q=i.map((d,P)=>`${P+1}. ${d.tool}${d.brief?` \u2192 ${d.brief}`:""}${d.error?" [ERROR]":""} (${d.durationMs}ms)`),V=!!(n.slashSkill||i.some(d=>d.tool==="Skill")),z=i.some(d=>d.tool==="Agent");if(!V&&!z){a("Stop",`sid

15`),process.stdout.write(JSON.stringify(e));}}Hr().catch(t=>{process.stderr.write(`[flow-obs] fatal: ${t.message}

16`),process.exit(0);});

Long lines were clipped for display.

dist/cli.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2'use strict';var Pe=require('readline/promises'),ms=require('https'),g=require('fs'),lt=require('os'),It=require('path'),child_process=require('child_process'),Ps=require('http'),util=require('util'),crypto=require('crypto');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}function _interopNamespace(e){if(e&&e.__esModule)return e;var n=Object.create(null);if(e){Object.keys(e).forEach(function(k){if(k!=='default'){var d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:function(){return e[k]}});}})}n.default=e;return Object.freeze(n)}var ...

3`);}catch(i){throw r.close(),i}if(r.close(),e!==void 0)return e;throw new Error("Too many invalid attempts for yes/no prompt")}async function Sr(t,e){let r=Pe__namespace.createInterface({input:process.stdin,output:process.stdout});try{let n=(await r.question(`${t}: `)).trim();if(e);return n}catch(n){throw n}finally{r.close();}}var Ce=m(()=>{"use strict";});var Ot={};M(Ot,{checkForUpdate:()=>ys,checkForUpdateInteractive:()=>_s,fetchLatestVersionAsync:()=>kr,isNewer:()=>_t,primeUpdateCache:()=>Os});function C(){return Ne||(Ne=oe()),Ne}function _t(t,e){let r=o=>{let i=String(o).replace(/^v/,"").m ...

4 \u256D${i}\u256E

5 \u2502${n.padEnd(o)}\u2502

6 \u2502${s.padEnd(o)}\u2502

7 \u2570${i}\u256F

9`);}function $e(t){let e=C().name;process.stderr.write(`

10 [${e}] Critical update detected \u2014 auto-updating to ${t}...

12`),child_process.spawn("npm",["install","-g",`${e}@${t}`],{detached:true,stdio:"ignore",windowsHide:true}).unref();}async function Ts(t,e=1e4){let r=xt("readline"),n=C().name,o=` Update available: ${C().

13 \u256D${l}\u256E

14 \u2502${o.padEnd(c)}\u2502

15 \u2502${i.padEnd(c)}\u2502

16 \u2502${a.padEnd(c)}\u2502

17 \u2570${l}\u256F

18 `),new Promise(d=>{let h=r.createInterface({input:process.stdin,output:void 0,terminal:false}),w=false;function T(_){w||(w=true,clearTimeout(A),h.close(),process.stderr.write(`

19`),d(_));}let A=setTimeout(()=>T(false),e);h.once("line",_=>T(_.trim().toLowerCase()==="y")),h.once("close",()=>T(false));})}async function Ss(t){let e=C

20`),new Promise(r=>{let n=child_process.spawn("npm",["install","-g",`${e}@${t}`],{stdio:"inherit"});n.on("close",s=>{s!==0?process.stderr.write(` \u2717 Update failed \u2014 continuing with current version.

22`):process.stderr.write(` \u2713 Updated to ${t}. Please restart the command.

24`),r();}),n.on("error",()=>{process.stderr.write(` \u2717 Update failed \u2014 continuing with current version.

26`),r();});})}function kr(){return new Promise(t=>{De((e,r)=>t(e||!r?null:r));})}function ys(){try{let t=Fe();if(t){_t(C().version,t.latestVersion)&&(t.updatePriority

27`;try{g.writeFileSync(Rs,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

28`);}}var Rs,D=m(()=>{"use strict";O();Rs=It.join(lt.tmpdir(),vr);});function Cs(t){if(!bs.test(t))throw new Error(`Invalid tenant value: "${t}". Tenant must be lowercase alphanumeric and hyphens (1-64 chars).`)}function Ns(t,e){let r=e.length>400?e.slice(0,400)+"\u2026":e;u("toAuthError",`status=${t} body=${r}`);try{let n=JSON.parse(e);if(typeof n.error=="string"&&(u("toAuthError",`api_error_code=${n.error}`+(n.message?` api_message=${n.message}`:"")),Lr[n.error]))return new ct(Lr[n.error])}catch{}return t===401||t===403||t===500?new ct("Invalid credentials"):t>=400&&t<500?new ct("Authenticati ...

29`+L(` \u2717 flow-ai-obs is not supported in a sudo context.

31`)+R(` npm install -g @ciandt-flow/flow-ai-obs

32`)+`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L19

33`),1}var Mt=m(()=>{"use strict";it();});function Ir(){if(process.platform==="linux"&&process.getuid?.()===0&&process.env.SUDO_USER){let e=child_process.spawnSync("getent",["passwd",process.env.SUDO_USER],{encoding:"utf8",timeout:5e3}).stdout?.split

34`,{encoding:"utf8",mode:384});try{g__namespace.chmodSync(t,384);}catch{}}finally{fe(e);}return {settingsPath:t,preserved:r}}function Rt(t){try{let e=g__namespace.readFileSync(v(),"utf8"),n=JSON.parse(e).env?.[t];return typeof n=="string"?n:null}catch{return null}}function J(t){let e=v(),r=e+".lock";g__namespace.mkdirSync(It__namespace.dirname(e),{recursive:true}),pe(r);try{let n={};try{n=JSON.parse(g__namespace.readFileSync(e,"utf8"));}catch{}(!n.env||typeof n.env!="object")&&(n.env={}),Object.assign(n.env,t),g__namespace.writeFileSync(e,JSON.stringify(n,null,2)+`

35`,{encoding:"utf8",mode:384});try{g__namespace.chmodSync(e,384);}catch{}}finally{fe(r);}}function Fr(){let t=v(),e=t+".lock",r=[];g__namespace.mkdirSync(It__namespace.dirname(t),{recursive:true}),pe(e);try{if(g__namespace.existsSync(t)){g__namespace.copyFileSync(t,t+".bkp");try{g__namespace.chmodSync(t+".bkp",384);}catch{}}let n={};try{n=JSON.parse(g__namespace.readFileSync(t,"utf8"));}catch{}n.otelHeadersHelper="flow-ai-obs otel-headers",(!n.hooks||typeof n.hooks!="object"||Array.isArray(n.hooks))&&(n.hooks={});let s=(a,c)=>({matcher:"",hooks:[{type:"command",command:`flow-ai-obs ${a}`,timeou ...

36`,{encoding:"utf8",mode:384});try{g__namespace.chmodSync(t,384);}catch{}}finally{fe(e);}return {settingsPath:t,preserved:r}}function xr(t){let e=v(),r=e+".lock";g__namespace.mkdirSync(It__namespace.dirname(e),{recursive:true}),pe(r);try{let n={};try{n=JSON.parse(g__namespace.

37`,{encoding:"utf8",mode:384});try{g__namespace.chmodSync(e,384);}catch{}}finally{fe(r);}}var Us,Vt=m(()=>{"use strict";O();vt();ue();We();Us=Ar.LOCK_STALE_MS;});function Wt(){let t=lt__namespace.default.homedir();if(process.platform===

38 ${{darwin:`brew install node

39 or download from: https://nodejs.org`,win32:`winget install OpenJS.NodeJS

Long lines were clipped for display.