@gethookmyapp/cli@0.14.29
HookMyApp CLI, No BS. Just go live.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI's default crash reporting attaches the logged-in account's email and user ID to Sentry events. This behavior is disclosed and can be disabled, but identifying details in runtime telemetry warrant a warning.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A CLI error eligible for capture, while telemetry is enabled.
Impact
The telemetry provider receives identifying account details with crash reports.
Mechanism
The CLI reads the saved access token or credential email, extracts the account subject and email, and attaches them to a Sentry crash report.
AI rationale
The CLI's default crash reporting attaches the logged-in account's email and user ID to Sentry events. This behavior is disclosed and can be disabled, but identifying details in runtime telemetry warrant a warning.
Evidence
dist/cli.js
Network endpoints1
4abeaf940e214f8c69d1af0f3ae800f7@o4511121201627136.ingest.de.sentry.io/4511251477561424
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Crash reports sent to Sentry include the logged-in account's email and user ID.
- Telemetry is enabled unless disabled in config or with HOOKMYAPP_TELEMETRY=off.
- Telemetry includes a Sentry endpoint and the package also discloses the account identifiers sent with crash reports.
Evidence against
- The package discloses crash and usage telemetry, including the account identifiers attached to crash reports.
- The disclosure says command arguments, file contents, and environment variable values are not sent, except feedback submitted intentionally.
- Telemetry can be disabled through config or HOOKMYAPP_TELEMETRY=off.
- The CLI's production API profile uses HookMyApp's own API host; review found no confirmed unrelated credential redirect.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscation
Source & flagged code
9 flaggeddist/cli.jsView file
48* Constructs the CommanderError class
L49: * @param {number} exitCode suggested exit code which could be used with process.exit
L50: * @param {string} code an id string representing the error
...
L1204: var EventEmitter = __require("node:events").EventEmitter;
L1205: var childProcess4 = __require("node:child_process");
L1206: var path3 = __require("node:path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str2) => process19.stdout.write(str2),
L1256: writeErr: (str2) => process19.stderr.write(str2),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4848Trigger-reachable chain: manifest.bin -> bin/hookmyapp.js -> dist/cli.js
L48: * Constructs the CommanderError class
L49: * @param {number} exitCode suggested exit code which could be used with process.exit
L50: * @param {string} code an id string representing the error
...
L1204: var EventEmitter = __require("node:events").EventEmitter;
L1205: var childProcess4 = __require("node:child_process");
L1206: var path3 = __require("node:path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str2) => process19.stdout.write(str2),
L1256: writeErr: (str2) => process19.stderr.write(str2),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsFindings
2 Critical6 High4 Medium6 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
HighKnown Malware Source Similaritydist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @gethookmyapp/cli@0.14.29.
See all versions of @gethookmyapp/cli for other recorded verdicts.
- Review the evidence and your use of @gethookmyapp/cli@0.14.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.