@flashcatcloud/electron-sdk@0.4.0
FlashCat SDK for Electron applications
AI Security Review
scanned 1d ago · by lpm-firewall-aiThis is a warning-level telemetry concern: sampled error events include raw stack traces that can reveal local paths and are sent to the configured intake. The behavior requires an explicit SDK `init` call and can be disabled with a zero telemetry sample rate, so it is suspicious rather than malicious.
Decision evidence
public snapshot- After `init`, the SDK enables error telemetry by default; the README lists a 20% default sample rate.
- Telemetry error events include error messages and raw stack traces, which can contain local paths.
- The SDK posts collected events to its configured RUM intake using the supplied client token.
- Telemetry starts only when the application calls the SDK’s `init` function.
- The README identifies the feature as telemetry and exposes `telemetrySampleRate` to control it.
- The upload destination is the configured intake host; the README documents FlashCat’s default host.
- A separate `instrument` entry disables dd-trace’s own instrumentation telemetry by default.
- The manifest’s `prepare` script runs Husky; no package install hook sending data was identified.
Source & flagged code
3 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/instrument.cjs#virtual:normalized:round1View on unpkgTarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @flashcatcloud/electron-sdk@0.4.0.
See all versions of @flashcatcloud/electron-sdk for other recorded verdicts.
- Review the evidence and your use of @flashcatcloud/electron-sdk@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.