registry / @expo/agent-cli
@expo/agent-cli
Agent-native CLI on top of the Expo CLI family
This report shows the evidence for @expo/agent-cli@1.0.23. 0 of 17 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe routed findings resolve to expected Expo CLI behavior: disclosed command telemetry and user-confirmed agent setup. The source reviewed does not show credential collection, unrelated data exfiltration, or hidden automatic configuration changes.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Telemetry runs after CLI commands; agent configuration writes occur during an explicit agents:setup command.
Impact
The reviewed flows disclose their behavior and provide telemetry opt-outs; no credential or project-content exfiltration or unrequested account action was identified.
Mechanism
A detached worker sends command name and limited runtime context to Expo telemetry. The setup command writes managed instructions after user selection and confirmation.
AI rationale
The routed findings resolve to expected Expo CLI behavior: disclosed command telemetry and user-confirmed agent setup. The source reviewed does not show credential collection, unrelated data exfiltration, or hidden automatic configuration changes.
Evidence
~/.expo/state.json~/.expo/agent-cli-telemetry-idAGENTS.mdCLAUDE.md
Network endpoints1
cdp.expo.dev/v1/batch
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and lists only a prepublish build hook, not an install hook; the bin file loads the CLI.
- Telemetry is documented as command usage data and excludes arguments, project contents, credentials and output.
- Telemetry can be disabled with EXPO_NO_TELEMETRY=1 or EXPO_OFFLINE=1.
- Agent instruction-file setup is an explicit agents:setup action with a confirmation step; its managed block is written as part of that setup.
Evidence against
- The CLI sends telemetry to cdp.expo.dev by default after commands.
- Setup can write managed agent instructions and references into AGENTS.md and CLAUDE.md.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
11 flaggedbuild/cli/8796.index.jsView file
97const exec = await resolution.load();
L98: await exec(resolution.argv);
L99: return;
High
Child Process
Package source references child process execution.
build/cli/8796.index.jsView on unpkg · L97build/cli/4108.index.jsView file
88192if (callee.isIdentifier() && !path.scope.getBinding(callee.node.name) && (isValidObjectCallee(callee.node.name) || isValidIdentifierCallee(callee.node.name))) {
L88193: func = global[callee.node.name];
L88194: }
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
build/cli/4108.index.jsView on unpkg · L8819265Cross-file remote execution chain: build/cli/4108.index.js spawns build/cli/index.js; helper contains network access plus dynamic code execution.
L65: // Defaults to true.
L66: // https://docs.expo.dev/versions/latest/config/app/#allowbackup
L67: return config.android?.allowBackup ?? true;
...
L156: try {
L157: const prevValue = JSON.parse(oldProp.value);
L158: const newValue = JSON.parse(value);
...
L765: ],
L766: data: renderIntentFilterData(intentFilter.data),
L767: category: renderIntentFilterCategory(intentFilter.category)
...
L5276: src,
L5277: newSrc: ` pod 'react-native-google-maps', path: File.dirname(\`node --print "require.resolve('react-native-maps/package.json')"\`)`,
L5278: anchor: /use_native_modules/,
Findings
1 Critical8 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltabuild/cli/7627.index.js
HighChild Processbuild/cli/8796.index.js
HighSame File Env Network Executionbuild/cli/index.js
HighCommand Output Exfiltrationbuild/telemetry/index.js
HighObfuscated Payload Loaderbuild/cli/4108.index.js
HighExternal Ai Agent Control Surface Mutationbuild/cli/7248.index.js
HighCross File Remote Execution Contextbuild/cli/4108.index.js
HighRuntime Package Installbuild/cli/2461.index.js
HighSemantic Analysis Limitedbuild/cli/1447.index.js#virtual:normalized:round1
MediumDynamic Requirebin/cli.js
MediumNetwork
Affected versions and remediation
This report applies to @expo/agent-cli@1.0.23.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @expo/agent-cli@1.0.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.