@gethookmyapp/cli@0.14.26
HookMyApp CLI, No BS. Just go live.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI sends identifying account details with crash reports to its configured Sentry service while telemetry is enabled by default. This disclosed, opt-out behavior is suspicious telemetry under the review rules, not credential theft.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Running the CLI with telemetry enabled; an eligible error triggers the account identity attachment and crash report.
Impact
The user's account email and ID are disclosed to the telemetry service; users can disable telemetry.
Mechanism
The CLI reads saved credentials, extracts the account user ID and email, and attaches them to Sentry error reports.
AI rationale
The CLI sends identifying account details with crash reports to its configured Sentry service while telemetry is enabled by default. This disclosed, opt-out behavior is suspicious telemetry under the review rules, not credential theft.
Evidence
dist/cli.js~/.config/hookmyapp/config.json~/.config/hookmyapp/sentry-offline/*.json
Network endpoints2
o4511121201627136.ingest.de.sentry.ious.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When telemetry is enabled, Sentry reads the saved access token to obtain the account user ID and email and attaches them to crash reports.
- Sentry telemetry is enabled by default and can be disabled through the config setting or environment variable.
- The CLI initializes Sentry during startup and attaches the logged-in account identity when capturing eligible errors.
- The package also sends usage analytics to PostHog; its distinct ID uses a hashed HookMyApp API key when one is set.
Evidence against
- The manifest routes to the CLI binary and has no install, preinstall, or postinstall hook; prepublishOnly builds and runs tests.
- The telemetry disclosure says command arguments, file contents, and environment variable values are not sent, and identifies email and user ID as crash-report fields.
- Sentry capture is limited to eligible errors, and telemetry can be disabled.
- The API key used as a PostHog identifier is SHA-256 hashed and truncated; the raw key is not used as the identifier.
Behavioral surface
ChildProcess
Source & flagged code
9 flaggeddist/cli.jsView file
48* Constructs the CommanderError class
L49: * @param {number} exitCode suggested exit code which could be used with process.exit
L50: * @param {string} code an id string representing the error
...
L1204: var EventEmitter = __require("node:events").EventEmitter;
L1205: var childProcess4 = __require("node:child_process");
L1206: var path3 = __require("node:path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process19.stdout.write(str),
L1256: writeErr: (str) => process19.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4848Trigger-reachable chain: manifest.bin -> bin/hookmyapp.js -> dist/cli.js
L48: * Constructs the CommanderError class
L49: * @param {number} exitCode suggested exit code which could be used with process.exit
L50: * @param {string} code an id string representing the error
...
L1204: var EventEmitter = __require("node:events").EventEmitter;
L1205: var childProcess4 = __require("node:child_process");
L1206: var path3 = __require("node:path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process19.stdout.write(str),
L1256: writeErr: (str) => process19.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsFindings
2 Critical6 High4 Medium6 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
HighKnown Malware Source Similaritydist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @gethookmyapp/cli@0.14.26.
See all versions of @gethookmyapp/cli for other recorded verdicts.
- Review the evidence and your use of @gethookmyapp/cli@0.14.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.