@dotzero.ai/shared@1.5.0
Shared utilities for DotZero MCP servers
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package includes opt-out runtime telemetry that reports tool-call metadata and result sizes to DotZero’s service. The stored DotZero token is sent to that service, while the browser-auth helper is a user-invoked local login flow; the telemetry behavior warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer wraps a tool handler with instrumentTool and the tool is called; telemetry is on unless DOTZERO_TELEMETRY is set to an off value.
Impact
DotZero receives tool and client metadata, filtered argument values, outcome and timing data, HTTP status/count, and result byte counts.
Mechanism
The wrapper records tool-call details and queues events for POST to the DotZero MCP calls endpoint, authenticated with the stored DotZero token.
AI rationale
The package includes opt-out runtime telemetry that reports tool-call metadata and result sizes to DotZero’s service. The stored DotZero token is sent to that service, while the browser-auth helper is a user-invoked local login flow; the telemetry behavior warrants a warning rather than a block.
Evidence
dist/mcp-client/telemetry.jsdist/auth/browser-auth.jsdist/auth/client.js
Network endpoints1
agent-webui-api.dotzero.app/api/v1/mcp-calls
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- instrumentTool records tool-call metadata and queues a telemetry event after calls.
- The event includes sanitized arguments and the result’s byte count, not its text content.
- When telemetry is active, queued events are POSTed to the DotZero MCP calls endpoint using a stored DotZero token.
- Telemetry is enabled by default and can be disabled with DOTZERO_TELEMETRY.
Evidence against
- The browser-auth flow is an exported, user-invoked login helper that serves a local page and sends credentials to the configured DotZero User API.
- The browser-auth HTTP server binds to 127.0.0.1; importing the package does not itself start that server.
- The telemetry sender uses a DotZero API endpoint and sends the stored DotZero token to that service.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
5 flaggeddist/auth/browser-auth.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @dotzero.ai/shared@1.3.0
matchedIdentity = npm:QGRvdHplcm8uYWkvc2hhcmVk:1.3.0
similarity = 0.706
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/auth/browser-auth.jsView on unpkg1import http from"node:http";import{exec}from"node:child_process";import{login}from"./client.js";import{DEFAULT_USER_API_URL}from"./client.js";const DEFAULT_TIMEOUT=12e4;function op...
High
Child Process
Package source references child process execution.
dist/auth/browser-auth.jsView on unpkg · L11import http from"node:http";import{exec}from"node:child_process";import{login}from"./client.js";import{DEFAULT_USER_API_URL}from"./client.js";const DEFAULT_TIMEOUT=12e4;function op...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical5 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/auth/browser-auth.js
HighChild Processdist/auth/browser-auth.js
HighShell
HighSame File Env Network Executiondist/auth/browser-auth.js
HighCommand Output Exfiltrationdist/auth/browser-auth.js
HighTrigger Reachable Command Output Exfiltrationdist/auth/browser-auth.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @dotzero.ai/shared@1.5.0.
See all versions of @dotzero.ai/shared for other recorded verdicts.
- Review the evidence and your use of @dotzero.ai/shared@1.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.