@grovetech/defender@0.31.0
Active runtime protection for vibe-coded apps — drops in as Express middleware (web + AI layer), blocks prompt injection, PII leaks, and sensitive paths in real time. By Grovetech AI.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package does not show credential theft or install-time malicious behavior. However, its explicitly invoked `init` command sends undisclosed install telemetry by default, which warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Explicitly invoking `defender init`, including a dry run; the initial event is sent before confirmation.
Impact
Grovetech learns that initialization was attempted and may receive framework or outcome details; inspected payloads do not include project files or credentials.
Mechanism
The CLI POSTs install-event metadata and a timestamp to its default telemetry endpoint, or to the endpoint set in `GROVETECH_DEFENDER_INSTALL_URL`.
AI rationale
The package does not show credential theft or install-time malicious behavior. However, its explicitly invoked `init` command sends undisclosed install telemetry by default, which warrants a warning.
Evidence
dist/esm/cli.js
Network endpoints1
grovetechai.com/api/defender/install-telemetry
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The `defender init` command sends an `install_started` event before asking for confirmation.
- The event is POSTed to `https://grovetechai.com/api/defender/install-telemetry` by default and includes the event, CLI source, payload, and timestamp.
- The manifest exposes this code as a CLI; the reviewed telemetry sends install status and framework or error details, not project file contents or credentials.
Evidence against
- Telemetry runs only when a user invokes the `init` command; no install lifecycle hook triggers it.
- Replay mode sends the package’s Defender API key to the Defender API, matching the feature’s stated purpose.
- The README describes the product’s reporting features but does not disclose the CLI install telemetry or provide an opt-out.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedREADME.mdView file
•| AI input | "ignore previous instructions", DAN/jailbreak, token bombs |
High
Ai Reviewer Manipulation
Package text addresses the security reviewer or scanner and tries to influence the review outcome.
README.mdView on unpkgdist/esm/cli.jsView file
4// • `defender init [--dry-run] [--yes]` — autodetekuje framework, vloží
L5: // middleware do entry filu, přidá @grovetech/defender do package.json,
L6: // vytvoří/upraví .env.example a README.md, doinstaluje balíček.
...
L9: import { fileURLToPath } from "node:url";
L10: import { spawnSync } from "node:child_process";
L11: import { PII_PATTERNS } from "./patterns.js";
...
L25: const pkgPath = join(here, "..", "..", "package.json");
L26: const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
L27: if (pkg.version && /^\d+\.\d+\.\d+/.test(pkg.version))
...
L36: const MAX_FILE_BYTES = 2 * 1024 * 1024;
L37: const DEFAULT_INGEST = "https://grovetechai.com/api/defender/install-telemetry";
L38: function walk(root) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/esm/cli.jsView on unpkg · L4Findings
3 Critical5 High3 Medium5 Low
CriticalCredential Exfiltrationdist/esm/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/esm/cli.js
CriticalPrevious Version Dangerous Deltadist/cjs/proxy.cjs
HighAi Reviewer ManipulationREADME.md
HighChild Processdist/esm/cli.js
HighTrigger Reachable Credential Exfiltrationdist/esm/cli.js
HighRuntime Package Installdist/esm/cli.js
HighSemantic Analysis Limiteddist/cjs/agent-identity.cjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to @grovetech/defender@0.31.0.
See all versions of @grovetech/defender for other recorded verdicts.
- Review the evidence and your use of @grovetech/defender@0.31.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.