registry / @extenshi/cli / 0.15.0
@extenshi/cli@0.15.0
Pre-publish security scanner for browser extensions
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic inspection found a consent-gated PostHog install ping, not a concrete malicious chain. Scanner signals are explained by package-aligned CLI functionality and source-analysis rules.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm postinstall after prior telemetry consent, or explicit CLI commands
Impact
Sends bounded install telemetry only when prior consent exists; no credential harvesting, remote code execution, or agent-control mutation found.
Mechanism
consent-gated telemetry and user-invoked scan requests
AI rationale
Static inspection found a consent-gated PostHog install ping, not a concrete malicious chain. Scanner signals are explained by package-aligned CLI functionality and source-analysis rules.
Evidence
package.jsonscripts/postinstall.cjsdist/auto-update.jsdist/cli.jsdist/scan.jsdist/review-checks.js~/.extenshi/config.json
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook can send an install telemetry event after reading shared Extenshi config.
Evidence against
- Postinstall exits unless recorded telemetry consent is exactly true; it also skips CI, Do Not Track, and explicit telemetry opt-out.
- The hook sends a bounded PostHog payload and has a 2-second request timeout.
- Dynamic require only reads this package's package.json; review-checks contains detection rules, not runtime eval.
- Artifact upload and credential persistence occur through explicit CLI commands.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/review-checks.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @extenshi/cli@0.14.2
matchedIdentity = npm:QGV4dGVuc2hpL2NsaQ:0.14.2
similarity = 0.813
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
Findings
2 High5 Medium8 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/review-checks.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/auto-update.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/review-checks.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @extenshi/cli@0.15.0.
See all versions of @extenshi/cli for other recorded verdicts.
- Review the evidence and your use of @extenshi/cli@0.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.