@highflame/overwatch@2.1.3
IDE-agnostic security daemon for AI coding assistants. Evaluates prompts, tool calls, file operations, shell commands, and MCP usage in real time for Cursor, Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and Kiro.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe daemon automatically sends authenticated users’ email addresses and IDE identity to Highflame during hook processing, with no explicit telemetry opt-in found in the inspected flow. This is identifying runtime telemetry and warrants a warning; the package’s prompt and tool-event evaluation traffic otherwise matches its stated purpose.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A hook event handled by the daemon when the user is authenticated and an email is available.
Impact
Highflame receives identifying account and IDE usage data without an explicit telemetry opt-in in the inspected code.
Mechanism
The hook pipeline calls the installation check, which submits user_id, user_email, and IDE type to the Highflame installation endpoint.
AI rationale
The daemon automatically sends authenticated users’ email addresses and IDE identity to Highflame during hook processing, with no explicit telemetry opt-in found in the inspected flow. This is identifying runtime telemetry and warrants a warning; the package’s prompt and tool-event evaluation traffic otherwise matches its stated purpose.
Evidence
dist/daemon.js
Network endpoints2
control.highflame.ai/overwatch/installationsapi.highflame.ai/v1/cerberus
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The daemon records the authenticated user’s email as both user_id and user_email, along with the IDE type.
- The hook pipeline registers a callback that checks installation status; when authenticated with an email, it automatically submits an installation record.
- Installation records are POSTed to the configured Highflame API, whose default host is control.highflame.ai.
- The daemon also sends hook event payloads to its Cerberus service, consistent with the package’s stated prompt and tool-call evaluation purpose.
Evidence against
- Installation reporting is limited to authenticated users with an available email.
- Evaluating AI assistant prompts and tool calls is the package’s stated purpose, and those event payloads are sent to its own service.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
8 flaggeddist/index.jsView file
1245try {
L1246: const { execSync: execSync2 } = require("child_process");
L1247: const findCmd = isWindows ? `where ${genericBinaryName}` : `which ${genericBinaryName}`;
High
1897const entry = h;
L1898: return ![entry?.bash, entry?.powershell, entry?.command].some(
L1899: isLegacyOverwatchCommand
High
10};
L11: var __commonJS = (cb, mod) => function __require() {
L12: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L10dist/cli.jsView file
Findings
1 Critical5 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/daemon.js
HighChild Processdist/index.js
HighShelldist/index.js
HighCommand Output Exfiltrationdist/cli.js
HighCross File Remote Execution Contextdist/daemon.js
HighSemantic Analysis Limitedlib/platform-loader.js#virtual:normalized:round1
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/hooks/universal-hook.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Low
Affected versions and remediation
This report applies to @highflame/overwatch@2.1.3.
See all versions of @highflame/overwatch for other recorded verdicts.
- Review the evidence and your use of @highflame/overwatch@2.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.