registry / @ciandt-flow/flow-ai-obs / 0.8.2

@ciandt-flow/flow-ai-obs@0.8.2

⚠ Under review

Claude Code hooks for Langfuse OTLP tracing — cross-platform

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 122 KB of source, external domains: flow.ciandt.com, github.com, nodejs.org, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

Lines 1-38json

2 "name": "@ciandt-flow/flow-ai-obs",

3 "version": "0.8.2",

4 "description": "Claude Code hooks for Langfuse OTLP tracing — cross-platform",

5 "main": "dist/index.js",

6 "bin": {

7 "flow-ai-obs": "dist/cli.js",

8 "flow-ai-obs-setup": "dist/setup.js"

9 },

10 "scripts": {

11 "build": "tsup",

12 "test": "jest",

13 "typecheck": "tsc --noEmit",

14 "lint": "eslint src bin scripts",

15 "format": "prettier --write \"src/**/*.ts\" \"bin/**/*.ts\" \"scripts/**/*.ts\"",

16 "format:check": "prettier --check \"src/**/*.ts\" \"bin/**/*.ts\" \"scripts/**/*.ts\"",

17 "security-scan": "trufflehog filesystem src/ --fail --no-update --exclude-paths .trufflehogignore",

18 "postinstall": "node -e \"require('fs').existsSync('dist/setup.js') && require('child_process').execFileSync(process.execPath, ['dist/setup.js'], {stdio:'inherit'})\"",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "prepublishOnly": "npm run security-scan && npm run build",

20 "release:npm": "changeset publish",

21 "changeset": "changeset",

22 "version-packages": "changeset version",

23 "install:hooks": "node dist/cli.js install",

24 "auth:login": "node dist/cli.js auth login",

25 "auth:logout": "node dist/cli.js auth logout",

26 "auth:status": "node dist/cli.js auth status",

27 "smoke": "bash scripts/smoke-test.sh",

28 "smoke:debug": "bash scripts/smoke-test.sh --debug",

29 "smoke:send": "bash scripts/smoke-test.sh --send --allow-http --debug"

30 },

31 "files": [

32 "dist/",

33 "README.md",

34 "LICENSE.md"

35 ],

36 "keywords": [

37 "claude-code",

38 "langfuse",

dist/index.jsView file

Lines 1-16javascript

1'use strict';var child_process=require('child_process'),util=require('util'),I=require('fs'),x=require('path'),fe=require('os'

dist/cli.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2'use strict';var Re=require('readline/promises'),us=require('https'),S=require('fs'),lt=require('os'),Rt=require

Source & flagged code

9 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code