registry / @expo/agent-cli / 1.0.21
@expo/agent-cli@1.0.21
Agent-native CLI on top of the Expo CLI family
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged telemetry is disclosed in the README, sends command-usage data to Expo’s telemetry service, and can be disabled with EXPO_NO_TELEMETRY or EXPO_OFFLINE. Agent instructions are written through the documented, explicit agents:setup command; no malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Telemetry follows CLI command use; agent setup runs through the explicit agents:setup command.
Impact
The disclosed telemetry reports usage and context; setup changes agent instructions only when requested.
Mechanism
A detached worker sends command-usage telemetry to Expo. The setup command can write a managed block to AGENTS.md.
AI rationale
The flagged telemetry is disclosed in the README, sends command-usage data to Expo’s telemetry service, and can be disabled with EXPO_NO_TELEMETRY or EXPO_OFFLINE. Agent instructions are written through the documented, explicit agents:setup command; no malicious behavior was identified.
Evidence
AGENTS.md
Network endpoints1
cdp.expo.dev/v1/batch
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package is an Expo CLI with a bin entry and bundled CLI main.
- The README discloses command-usage telemetry, its fields, exclusions, and the EXPO_NO_TELEMETRY or EXPO_OFFLINE opt-out.
- The telemetry worker sends command name and version with anonymous or hashed identity and runtime, agent, and sandbox context.
- Telemetry is launched as a detached worker after a command and honors the telemetry opt-out.
- The CLI describes agents:setup as a command that confirms agent setup; its managed-block writer updates AGENTS.md when invoked.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
10 flaggedbuild/cli/8796.index.jsView file
97const exec = await resolution.load();
L98: await exec(resolution.argv);
L99: return;
High
Child Process
Package source references child process execution.
build/cli/8796.index.jsView on unpkg · L97build/cli/8734.index.jsView file
5035L5036: module.exports = eval("require")("bufferutil");
L5037:
Low
Eval
Package source references a known benign dynamic code generation pattern.
build/cli/8734.index.jsView on unpkg · L5035bin/cli.jsView file
2L3: require('../build/cli');
Medium
Findings
1 Critical6 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltabuild/cli/2461.index.js
HighChild Processbuild/cli/8796.index.js
HighSame File Env Network Executionbuild/cli/index.js
HighCommand Output Exfiltrationbuild/telemetry/index.js
HighExternal Ai Agent Control Surface Mutationbuild/cli/7248.index.js
HighRuntime Package Installbuild/cli/6673.index.js
HighSemantic Analysis Limitedbuild/cli/1447.index.js#virtual:normalized:round1
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filebuild/cli/8103.index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @expo/agent-cli@1.0.21.
See all versions of @expo/agent-cli for other recorded verdicts.
- Review the evidence and your use of @expo/agent-cli@1.0.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.