registry / @extenshi/cli / 0.33.0
@extenshi/cli@0.33.0
Pre-publish security scanner for browser extensions
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall telemetry is guarded by recorded affirmative consent and opt-out checks, and sends limited package-aligned adoption data. The scanner’s execution and network indicators correspond to the CLI’s documented functions; the inspected source did not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation, when the package is under node_modules and the existing user config has telemetry set to true.
Impact
An opted-in user’s installation and coarse runtime details are reported for adoption measurement; no confirmed attack impact was found.
Mechanism
The postinstall script posts an anonymous installation event with package version and coarse runtime metadata to the configured PostHog host, which defaults to the Extenshi collector.
AI rationale
The postinstall telemetry is guarded by recorded affirmative consent and opt-out checks, and sends limited package-aligned adoption data. The scanner’s execution and network indicators correspond to the CLI’s documented functions; the inspected source did not establish malicious behavior.
Evidence
scripts/postinstall.cjspackage.json
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs scripts/postinstall.cjs during installation, and the script sends an installation event only when the existing config explicitly has telemetry set to true; it also honors opt-out variables and skips CI and workspace installs.
- The install event goes to the Extenshi PostHog collector and contains an anonymous install ID plus package and runtime metadata; no credentials or package contents are included in the request.
- The inspected runtime and dependency entrypoints support the stated CLI, browser testing, publishing, and rendering functions; no concrete attack behavior was identified.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/login-runtime.jsView file
11*/
L12: import { spawn } from 'node:child_process';
L13: import http from 'node:http';
High
Child Process
Package source references child process execution.
dist/login-runtime.jsView on unpkg · L11Findings
1 Critical5 High5 Medium9 Low
CriticalPrevious Version Dangerous Deltadist/firefox-rdp.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/login-runtime.js
HighShell
HighRuntime Package Installdist/amo-source.js
HighSemantic Analysis Limiteddist/cli.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/screenshots.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
Affected versions and remediation
This report applies to @extenshi/cli@0.33.0.
See all versions of @extenshi/cli for other recorded verdicts.
- Review the evidence and your use of @extenshi/cli@0.33.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.