@flashcatcloud/electron-sdk@0.4.1
FlashCat SDK for Electron applications
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe source matches an Electron RUM SDK: the application explicitly initializes it with a client token and site, and event uploads go to that configured intake. The instrumentation entry point disables dd-trace’s separate telemetry by default, consistent with its documentation.
Decision evidence
public snapshot- The manifest points to the SDK’s bundled entry points and has no preinstall, install, or postinstall script.
- The README instructs applications to call init with their FlashCat client token, application ID, and site to start monitoring.
- The SDK sends event batches to its configured intake using the client token supplied in that configuration.
- The instrument entry point disables dd-trace’s separate telemetry by default, and the README documents how an application can explicitly enable it.
Source & flagged code
3 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/instrument.cjs#virtual:normalized:round1View on unpkgTarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @flashcatcloud/electron-sdk@0.4.1.
See all versions of @flashcatcloud/electron-sdk for other recorded verdicts.
- Review the evidence and your use of @flashcatcloud/electron-sdk@0.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.