registry / @glassnote/client / 2.4.20
@glassnote/client@2.4.20
GlassNote — cliente de escritorio de notas superpuestas. Se instala con npx, sin instaladores nativos ni firmas.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged process execution and persistence implement the desktop client’s launcher, updater, and own auto-start behavior. The runtime report sends only a device UUID and version to origins already configured by the user; no malicious behavior was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the CLI starts the client; auto-start setup runs during client startup except in ephemeral npx mode. Version reporting starts during client startup.
Impact
The reviewed behavior supports the desktop client’s launch and update functions; no credential collection, unrelated persistence, or harmful action was identified.
Mechanism
The client registers its own launch command for system startup and periodically sends a UUID and package version to server origins from its user configuration.
AI rationale
The flagged process execution and persistence implement the desktop client’s launcher, updater, and own auto-start behavior. The runtime report sends only a device UUID and version to origins already configured by the user; no malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as Glassnote’s desktop overlay-notes client and exposes a CLI launcher.
- The launcher’s default command starts the client; install, update, and uninstall are separate commands.
- Auto-start setup is skipped for ephemeral npx runs and otherwise registers Glassnote itself to start with the system.
- Version reports contain only a device UUID and package version, and are sent only to origins already listed in the user’s server configuration.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggedautoStart.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @glassnote/client@2.4.15
matchedIdentity = npm:QGdsYXNzbm90ZS9jbGllbnQ:2.4.15
similarity = 0.563
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
autoStart.jsView on unpkg12const os = require('os');
L13: const { execSync, spawn } = require('child_process');
L14:
High
bin/glassnote.jsView file
•Trigger-reachable chain: scripts.start -> bin/glassnote.js
Reachable file contains a blocking source-risk pattern.
Critical
Findings
3 Critical4 High4 Medium6 Low
CriticalSame File Env Network Executionbin/glassnote.js#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilitybin/glassnote.js
CriticalPrevious Version Dangerous DeltaautoStart.js
HighChild ProcessautoStart.js
HighShell
HighTrigger Reachable Persistencebin/glassnote.js
HighSemantic Analysis Limitedbin/glassnote.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/glassnote.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @glassnote/client@2.4.20.
See all versions of @glassnote/client for other recorded verdicts.
- Review the evidence and your use of @glassnote/client@2.4.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.