@devvit/cli@0.15.2
Reddit's Dev Platform CLI Tool
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI sends command-line arguments to its own telemetry service by default and redacts only a narrow command class, creating a risk that sensitive arguments are collected. Metrics have disable and opt-out controls, so this is suspicious telemetry rather than a clear attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI startup for a valid command, unless metrics are disabled or opted out.
Impact
Sensitive values included in other command arguments may be reported to the vendor’s telemetry service.
Mechanism
The startup hook builds a raw command-line event, redacting only `settings set`, and sends it with a session ID to the Devvit events API.
AI rationale
The CLI sends command-line arguments to its own telemetry service by default and redacts only a narrow command class, creating a risk that sensitive arguments are collected. Metrics have disable and opt-out controls, so this is suspicious telemetry rather than a clear attack.
Evidence
dist/lib/hooks/init/fire-event.jsdist/util/metrics.jsdist/util/clientGenerators.jsdist/util/config.js~/.devvit/session-id
Network endpoints1
developers.reddit.com/api/events
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The startup hook sends a command-line event for CLI commands, and metrics are enabled unless disabled or opted out.
- The hook forwards raw command arguments, redacting only `settings set`; those arguments can include sensitive values.
- Events are sent to the Devvit portal events API, and the CLI stores a telemetry session ID locally.
Evidence against
- The event goes to the package’s own Devvit portal service, not an unrelated collector.
- Metrics can be disabled with `DEVVIT_DISABLE_METRICS` or the local opt-out file.
- The package has no lifecycle scripts; the flagged npm install runs from the explicit `init` command in the project directory.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/util/kill-process-tree.jsView file
1import { spawnSync } from 'node:child_process';
L2: import { execaCommand } from 'execa';
High
Child Process
Package source references child process execution.
dist/util/kill-process-tree.jsView on unpkg · L1dist/commands/upload.jsView file
22import chalk from 'chalk';
L23: import { execaCommand } from 'execa';
L24: import { REDDIT_DESKTOP } from '../lib/config.js';
High
dist/lib/hooks/init/check-node-version.jsView file
8
Findings
1 Critical4 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/commands/publish.js
HighChild Processdist/util/kill-process-tree.js
HighShelldist/commands/upload.js
HighRuntime Package Installdist/commands/init.js
HighSemantic Analysis Limiteddist/commands/init.js#virtual:normalized:round1
MediumDynamic Requiredist/lib/hooks/init/check-node-version.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/devvit.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @devvit/cli@0.15.2.
See all versions of @devvit/cli for other recorded verdicts.
- Review the evidence and your use of @devvit/cli@0.15.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.