@kubb/cli@5.15.0
Official CLI for Kubb. Run kubb generate, kubb init, kubb validate, kubb studio, and kubb mcp to manage the full code generation lifecycle.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe unfiltered transfer of user-configured plugin values creates a concrete data disclosure risk, though no specific credential transfer or malicious intent is established. The scanner’s account-action locations resolve to worker bookkeeping, and the manifest contains no install lifecycle hook.
Decision evidence
public snapshot- After generation, the CLI reports configured plugin names and option objects to telemetry.
- Telemetry serializes plugin option values without filtering their contents before sending the payload.
- The telemetry request goes to Kubb’s endpoint and is skipped when either telemetry opt-out setting is enabled.
- The package manifest has no install hook; its scripts are build, start, and typecheck.
- The flagged account-action locations describe worker files and worker startup, status, and error handling.
- This is package-aligned telemetry to Kubb’s own endpoint, and the send path honors the two telemetry opt-out settings.
- The inspected source does not establish that a plugin option contains a credential or other secret.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/snapshot-D7Ytw8S0.cjsView on unpkg · L12A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/run-Bb19PlwV.cjs#virtual:normalized:round1View on unpkgFindings
Affected versions and remediation
This report applies to @kubb/cli@5.15.0.
See all versions of @kubb/cli for other recorded verdicts.
- Review the evidence and your use of @kubb/cli@5.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.