@hs-x/cli@0.4.11
HS-X CLI — init, validate, connect, dev, deploy, promote, rollback, doctor, sync. Installs the `hs-x` command.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThis version sends identifying deployment telemetry to the package's own control plane after an explicit deploy, but the event is not covered by the CLI telemetry disclosure or opt-out. The evidence supports a telemetry warning rather than credential theft or malicious behavior.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A successful unlinked Cloudflare deployment, when a machine secret is available.
Impact
HS-X receives stable machine and project/deployment identifiers. This is undisclosed identifying telemetry, but the source does not show credentials being sent to an unrelated host.
Mechanism
The CLI posts a deploy event authenticated with the machine secret. The request includes a machine ID and can include project ID, deploy ID, environment, and worker URL. The destination defaults to api.hs-x.dev.
AI rationale
This version sends identifying deployment telemetry to the package's own control plane after an explicit deploy, but the event is not covered by the CLI telemetry disclosure or opt-out. The evidence supports a telemetry warning rather than credential theft or malicious behavior.
Evidence
dist/commands/deploy.jsdist/config.jsdist/services/machine-id.jsdist/telemetry.js
Network endpoints2
api.hs-x.dev/v1/machines/{machineId}/eventsapi.cloudflare.com/client/v4/accounts/{accountId}/workers/subdomain
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After a successful unlinked Cloudflare deploy, the CLI sends a deploy event when a machine secret is available.
- The event uses a persistent machine ID and includes the project ID, deploy ID, environment, and worker URL; the machine secret authenticates the request to the service.
- The event goes to the HS-X control plane, whose default host is api.hs-x.dev.
- The separate telemetry notice describes only command, exit code, duration, OS and architecture, says there is no stable identifier, and offers opt-outs; the deploy event does not use that telemetry gate.
- Deploys require user consent, and the Cloudflare API token lookup sends its token to the Cloudflare API host.
Evidence against
- No install lifecycle scripts are declared.
- The deploy event is sent only after a successful unlinked Cloudflare deployment, not on package install or import.
- The machine secret is sent to the HS-X control plane, while the Cloudflare token lookup targets Cloudflare's API.
Behavioral surface
ChildProcessCrypto
Source & flagged code
6 flaggeddist/dev/compat-shim.jsView file
67export async function loadDevStack() {
L68: const portManager = await import('@hubspot/local-dev-lib/portManager');
L69: const config = await import('@hubspot/local-dev-lib/config');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/dev/compat-shim.jsView on unpkg · L6771const loggerMod = await import('@hubspot/local-dev-lib/logger');
L72: const importRuntime = new Function('specifier', 'return import(specifier)');
L73: const parsing = await importRuntime('@hubspot/project-parsing-lib/translate');
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/dev/compat-shim.jsView on unpkg · L71dist/commands/deploy.jsView file
1import { spawn } from 'node:child_process';
L2: import { createHash, randomBytes } from 'node:crypto';
L3: import { lstat, mkdir, readFile, readdir, realpath, rename, rmdir, stat, unlink, writeFile, } from 'node:fs/promises';
L4: import { createServer } from 'node:http';
L5: import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
...
L64: const explicitFlag = resolveFlag(input.argv, '--account-id');
L65: const fromFlag = explicitFlag ?? process.env.HSX_ACCOUNT_ID;
L66: if (fromFlag && fromFlag.length > 0) {
...
L144: }
L145: return { exitCode: 10 };
L146: }
...
L244: headers: { 'content-type': 'application/x-www-form-urlencoded' },
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/hubspot-auth.js
HighCredential Exfiltrationdist/commands/deploy.js
HighTrigger Reachable Credential Exfiltrationdist/commands/deploy.js
HighSemantic Analysis Limiteddist/commands/doctor.js#virtual:normalized:round1
MediumDynamic Requiredist/dev/compat-shim.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/dev/compat-shim.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hs-x/cli@0.4.11.
See all versions of @hs-x/cli for other recorded verdicts.
- Review the evidence and your use of @hs-x/cli@0.4.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.