@glassnote/client@2.4.17
GlassNote — cliente de escritorio de notas superpuestas. Se instala con npx, sin instaladores nativos ni firmas.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe runtime version report is automatic and has no visible user-facing disclosure or opt-out; under the review rules, undisclosed runtime telemetry is suspicious. The report contains a persistent device UUID and version, while the default server is the package’s own API, so this is a warning rather than evidence of credential theft.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
When the desktop app starts, the version report begins automatically. Auto-start setup runs on non-ephemeral launches.
Impact
The service can associate a stable device identifier with the installed client version. The startup entry also causes the app to run automatically at later logins.
Mechanism
The reporter posts the saved device UUID and package version to `/devices/report-version` at saved server origins. Startup configuration creates platform-specific launch entries.
AI rationale
The runtime version report is automatic and has no visible user-facing disclosure or opt-out; under the review rules, undisclosed runtime telemetry is suspicious. The report contains a persistent device UUID and version, while the default server is the package’s own API, so this is a warning rather than evidence of credential theft.
Evidence
main.jsversionReport.jspairing.jsautoStart.js~/.config/autostart/glassnote.desktop~/Library/LaunchAgents/com.glassnote.app.plist%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/glassnote.lnk
Network endpoints2
glassnoteapi.intermark.ec (default API host; reports use saved server origins)/devices/report-version
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The app starts a version reporter automatically; it reports after 15 seconds and repeats every six hours.
- The report sends a persistent device UUID and package version to `/devices/report-version` on saved server origins.
- On non-ephemeral launches, startup code configures OS auto-start entries by default.
Evidence against
- The version report contains only the device UUID and package version; the inspected code does not send credentials or file contents.
- Report destinations come from saved server settings, and pairing code uses GlassNote’s API host by default.
- The package is an Electron desktop notes app, and its documentation describes auto-start management as an application feature.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedautoStart.jsView file
12const os = require('os');
L13: const { execSync, spawn } = require('child_process');
L14:
High
bin/glassnote.jsView file
•Trigger-reachable chain: scripts.start -> bin/glassnote.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bin/glassnote.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @glassnote/client@2.4.15
matchedIdentity = npm:QGdsYXNzbm90ZS9jbGllbnQ:2.4.15
similarity = 0.813
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Findings
3 Critical4 High4 Medium6 Low
CriticalSame File Env Network Executionbin/glassnote.js#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilitybin/glassnote.js
CriticalPrevious Version Dangerous Deltabin/glassnote.js
HighChild ProcessautoStart.js
HighShell
HighTrigger Reachable Persistencebin/glassnote.js
HighSemantic Analysis Limitedbin/glassnote.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/glassnote.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @glassnote/client@2.4.17.
See all versions of @glassnote/client for other recorded verdicts.
- Review the evidence and your use of @glassnote/client@2.4.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.