@expo/agent-cli@1.0.22
Agent-native CLI on top of the Expo CLI family
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe CLI sends runtime command telemetry by default, including detected agent and sandbox context, without documenting that automatic collection in its README. This is undisclosed runtime telemetry, so the package is suspicious rather than malicious.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running CLI commands, unless telemetry is disabled or Expo offline mode is active.
Impact
Expo receives command names, package and runtime details, and detected agent and sandbox context without this telemetry being disclosed in the package README.
Mechanism
The CLI starts a detached worker that sends command and environment metadata to Expo’s telemetry endpoint.
AI rationale
The CLI sends runtime command telemetry by default, including detected agent and sandbox context, without documenting that automatic collection in its README. This is undisclosed runtime telemetry, so the package is suspicious rather than malicious.
Evidence
build/cli/index.jsbuild/telemetry/index.jsREADME.md
Network endpoints1
cdp.expo.dev/v1/batch
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Each CLI command starts a detached telemetry worker unless telemetry is disabled or Expo offline mode is active.
- The worker sends command telemetry to https://cdp.expo.dev/v1/batch and includes runtime, CI, agent, and sandbox context.
- The README documents metadata collection and opt-outs for the feedback command, but does not disclose the automatic command telemetry.
Evidence against
- The automatic telemetry payload contains the command name and package version; the inspected code does not show command arguments or output being sent.
- Agent instruction-file updates are implemented as a CLI setup operation, rather than an install hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
11 flaggedbuild/cli/8796.index.jsView file
97const exec = await resolution.load();
L98: await exec(resolution.argv);
L99: return;
High
Child Process
Package source references child process execution.
build/cli/8796.index.jsView on unpkg · L97build/cli/4108.index.jsView file
88192if (callee.isIdentifier() && !path.scope.getBinding(callee.node.name) && (isValidObjectCallee(callee.node.name) || isValidIdentifierCallee(callee.node.name))) {
L88193: func = global[callee.node.name];
L88194: }
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
build/cli/4108.index.jsView on unpkg · L8819265Cross-file remote execution chain: build/cli/4108.index.js spawns build/cli/index.js; helper contains network access plus dynamic code execution.
L65: // Defaults to true.
L66: // https://docs.expo.dev/versions/latest/config/app/#allowbackup
L67: return config.android?.allowBackup ?? true;
...
L156: try {
L157: const prevValue = JSON.parse(oldProp.value);
L158: const newValue = JSON.parse(value);
...
L765: ],
L766: data: renderIntentFilterData(intentFilter.data),
L767: category: renderIntentFilterCategory(intentFilter.category)
...
L5276: src,
L5277: newSrc: ` pod 'react-native-google-maps', path: File.dirname(\`node --print "require.resolve('react-native-maps/package.json')"\`)`,
L5278: anchor: /use_native_modules/,
Findings
1 Critical8 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltabuild/cli/2461.index.js
HighChild Processbuild/cli/8796.index.js
HighSame File Env Network Executionbuild/cli/index.js
HighCommand Output Exfiltrationbuild/telemetry/index.js
HighObfuscated Payload Loaderbuild/cli/4108.index.js
HighExternal Ai Agent Control Surface Mutationbuild/cli/7248.index.js
HighCross File Remote Execution Contextbuild/cli/4108.index.js
HighRuntime Package Installbuild/cli/6673.index.js
HighSemantic Analysis Limitedbuild/cli/1376.index.js#virtual:normalized:round1
MediumDynamic Requirebin/cli.js
MediumNetwork
Affected versions and remediation
This report applies to @expo/agent-cli@1.0.22.
See all versions of @expo/agent-cli for other recorded verdicts.
- Review the evidence and your use of @expo/agent-cli@1.0.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.