@kubb/cli@5.15.3
Official CLI for Kubb. Run kubb generate, kubb init, kubb validate, kubb studio, and kubb mcp to manage the full code generation lifecycle.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package sends runtime telemetry to its own endpoint by default and includes serialized plugin options, which may expose user-provided configuration. The endpoint and opt-out are visible in source, and no credential theft or unrelated collection was identified; this merits a warning for undisclosed runtime telemetry.
Decision evidence
public snapshot- CLI commands send runtime telemetry to https://otlp.kubb.dev by default; users can disable it with DO_NOT_TRACK or KUBB_DISABLE_TELEMETRY.
- Telemetry includes serialized plugin options, which can contain user-provided configuration values.
- Studio command execution starts telemetry reporting without a separate consent step.
- The telemetry endpoint belongs to Kubb, and the code documents telemetry as anonymous usage reporting.
- The payload uses random trace and span IDs and includes command, version, runtime, platform, CI, status, plugin and file-count details.
- The package has no lifecycle scripts, and telemetry is tied to command runs rather than package import.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/snapshot-BHFRCLgH.cjsView on unpkg · L12A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/run-S6Hkmn-h.cjs#virtual:normalized:round1View on unpkgFindings
Affected versions and remediation
This report applies to @kubb/cli@5.15.3.
See all versions of @kubb/cli for other recorded verdicts.
- Review the evidence and your use of @kubb/cli@5.15.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.