@deveco-test/deveco-cli-common@1.3.11-Test.4
HarmonyOS application development command line tool
AI Security Review
scanned 14h ago · by lpm-firewall-aiThe package sends runtime usage telemetry to its DevEco service by default, with only an environment-variable opt-out and no disclosure found in the inspected README. This warrants a warning; the reviewed build event records option names rather than their values, and the endpoint matches the package’s stated purpose.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI startup initializes telemetry and schedules uploads; a background helper also flushes queued traces.
Impact
The service receives operational usage data without a documented consent prompt or disclosure found in the inspected README; command activity may be identifiable through the persistent install identifier.
Mechanism
The package records event details and an install identifier with platform and runtime metadata, then posts batches to the configured endpoint. Telemetry can be disabled with DEVECO_CLI_DISABLE_TELEMETRY=1 or true.
AI rationale
The package sends runtime usage telemetry to its DevEco service by default, with only an environment-variable opt-out and no disclosure found in the inspected README. This warrants a warning; the reviewed build event records option names rather than their values, and the endpoint matches the package’s stated purpose.
Evidence
dist/cli.jsdist/internal/telemetry-upload-background.js~/.local/share/deveco-cli/TraceLogData/install-id~/.local/share/deveco-cli/TraceLogData/trace-file-secret~/.local/share/deveco-cli/TraceLogData/telemetry-YYYY-MM-DD.txt~/.local/share/deveco-cli/TraceLogData/upload-state.json
Network endpoints1
cn.devecostudio.huawei.com/codeGenie/cli/trace/upload
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI initializes telemetry and starts its scheduler automatically unless DEVECO_CLI_DISABLE_TELEMETRY is enabled.
- A background helper reads queued traces and attempts to upload them when it runs.
- The uploader sends telemetry to https://cn.devecostudio.huawei.com/codeGenie/cli/trace/upload.
- Trace events include an install identifier, runtime and platform metadata, and event details.
Evidence against
- The upload endpoint is on Huawei’s DevEco Studio service domain, consistent with the package’s HarmonyOS CLI purpose.
- The disable switch accepts 1 or true, and the observed build event records option names rather than their values.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
11 flaggeddist/internal/telemetry-upload-background.jsView file
8`)+`
L9: `,"utf8")}catch{return}try{await u.promises.unlink(t)}catch{}}takeNewestWithinBudget(t,e){if(e<=0)return[];let r=[],i=0;for(let o=t.length-1;o>=0;o--){let s=Buffer.byteLength(t[o],...
High
Child Process
Package source references child process execution.
dist/internal/telemetry-upload-background.jsView on unpkg · L81import Vt from"path";import*as b from"fs";import*as Y from"path";import{homedir as St}from"os";import*as H from"fs";import*as g from"path";function W(n){let t=g.resolve(n),e=[],r=t...
L2: `;if(this.mode==="file"&&this.currentLogFile){if(this.fd===null&&this.openLogFile(),this.fd!==null)try{let p=Buffer.from(l);a.writeSync(this.fd,p),this.checkRotation(p.byteLength)}...
...
L8: `)+`
L9: `,"utf8")}catch{return}try{await u.promises.unlink(t)}catch{}}takeNewestWithinBudget(t,e){if(e<=0)return[];let r=[],i=0;for(let o=t.length-1;o>=0;o--){let s=Buffer.byteLength(t[o],...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/internal/telemetry-upload-background.jsView on unpkg · L1Findings
1 Critical5 High7 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/internal/telemetry-upload-background.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/internal/telemetry-upload-background.js
HighCommand Output Exfiltrationdist/internal/telemetry-upload-background.js
HighCross File Remote Execution Contextdist/cli.js
MediumDynamic Requiredist/internal/plugin-hook-runner.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarysrc/resources/uitest/uitest_agent_v1.1.9.so
MediumShips Wasm Moduleskills/hmos-dfx-analyzer/references/jscrash/scripts/hstack/lib/mappings.wasm
Affected versions and remediation
This report applies to @deveco-test/deveco-cli-common@1.3.11-Test.4.
See all versions of @deveco-test/deveco-cli-common for other recorded verdicts.
- Review the evidence and your use of @deveco-test/deveco-cli-common@1.3.11-Test.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.