@desplega.ai/agent-fs@0.18.9
Agent-first filesystem backed by S3
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe reviewed source shows default-on, opt-out telemetry containing a persistent installation identifier and operational metadata. This is a limited data exposure concern, while the inspected evidence does not establish malicious behavior or credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the agent-fs server while telemetry opt-out variables are unset.
Impact
The vendor receives an installation identifier and operational metadata; the source shown does not send credentials or file contents.
Mechanism
The CLI creates or reuses a persistent installation identifier and posts operational counts and environment metadata to the vendor telemetry endpoint.
AI rationale
The reviewed source shows default-on, opt-out telemetry containing a persistent installation identifier and operational metadata. This is a limited data exposure concern, while the inspected evidence does not establish malicious behavior or credential exfiltration.
Evidence
dist/cli.jspackage.json.lpm-dependency-evidence-27c1ecd1-ec84-41ac-bce2-f12abe87038d/2/npm-linux/package.json
Network endpoints1
proxy.desplega.sh/v1/events
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI sends server start and heartbeat events to the vendor telemetry service by default; setting either telemetry opt-out disables it.
- The telemetry event includes a persistent installation identifier, database counts, storage and embedding provider names, operating system, and architecture.
- The package's binary entry points to the reviewed CLI. Its prepublish hook only builds the package.
- The inspected Google GenAI dependency declares a no-op preinstall command.
Evidence against
- The telemetry code labels events anonymous and does not include credentials or file contents in the shown event properties.
- Telemetry uses an HTTPS endpoint associated with the package vendor, and the source provides opt-out controls.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
747};
L748: `,Iv;var Il=h(()=>{Iv=new WeakMap});import{and as Sv,eq as Ia,inArray as EO}from"drizzle-orm";async function xa(e,t,r,n){let o=e.$client,i=[],s=new Set;while(i.length<n){let a=Math...
L749: (${N.path} >= ${d} AND ${N.path} < ${l})
...
L751: (${N.path} >= ${c} AND ${N.path} < ${u})
L752: )`)}}if(t.parentId)r.push(W(N.parentId,t.parentId));else if(t.parentId===void 0&&!t.resolved)r.push(Ta`${N.parentId} IS NULL`),r.push(W(N.resolved,!1));else if(t.parentId===void 0&...
L753: ]))`;continue}else if(n[d]==="$"){o+=`($|(?=[\r
...
L760:
L761: `}},"x-sse-events":{"presence.snapshot":{...s,description:"Only sent when presence=1, immediately after ready."},"presence.updated":{type:"object",description:"Only sent when prese...
L762: Start a daemon with \`agent-fs daemon start\` or set
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/cli.jsView on unpkg · L7473var ZI=Object.create;var{getPrototypeOf:ex,defineProperty:ud,getOwnPropertyNames:tx}=Object;var bp=Object.prototype.hasOwnProperty;function rx(e){return this[e]}var nx,ox,bt=(e,t,r...
L4: Install with: brew install sqlite`)}var wp=!1;var Ep=h(()=>{px()});import{mkdirSync as mx,readFileSync as fx,writeFileSync as pd,existsSync as Ip}from"fs";import{join as _o}from"pa...
L5: CREATE TABLE IF NOT EXISTS org_invites (
...
L294: DELETE FROM meta WHERE key = 'vec_int8_index';
L295: `),!ko(n))n.exec(Ji);return Tp(n),Ax(n,{schema:de})}var fe=h(()=>{Ep();Et();xp();kp();bn()});var Pp;var Dp=h(()=>{Pp={name:"agent-fs",version:"0.18.9",packageManager:"bun@1.4.4",pr...
L296: ${this.getCanonicalPath(e)}
...
L305: ${Ir.toHex(i)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let t=[];for(let o of
Findings
3 Critical5 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
Affected versions and remediation
This report applies to @desplega.ai/agent-fs@0.18.9.
See all versions of @desplega.ai/agent-fs for other recorded verdicts.
- Review the evidence and your use of @desplega.ai/agent-fs@0.18.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.