@lemonway/terminal@0.1.0-beta.1
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package performs runtime telemetry to its own payment service, including shop and payment-order identifiers and error details, without a documented opt-out. This merits a warning, though the inspected behavior does not show credential theft or unrelated data collection.
Static reason
One or more suspicious static signals were detected.
Trigger
Calling init() sends a lifecycle log; SDK failures send additional logs.
Impact
Paygreen receives SDK usage and error context. No credential or machine-data collection was identified.
Mechanism
src/log.ts posts JSON to /api/log, including event names, shopId, paymentOrderId, error codes, and error details.
AI rationale
The package performs runtime telemetry to its own payment service, including shop and payment-order identifiers and error details, without a documented opt-out. This merits a warning, though the inspected behavior does not show credential theft or unrelated data collection.
Evidence
src/log.tssrc/index.tssrc/terminal/binding.tsxREADME.md
Network endpoints3
payment.paygreen.frsb-payment.paygreen.frrc-payment.paygreen.dev
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The SDK posts runtime logs to environment-specific Paygreen payment hosts.
- Log payloads include SDK event names, shop and payment-order IDs, error codes, and error details.
- Calling init() sends a log automatically; this call is part of normal SDK setup.
- Payment authorization failures also send error details to the logging endpoint.
- Documentation says shopId is used for SDK logs, but the logLevel option controls Stripe Terminal and does not disable these SDK posts.
- The prepare hook runs the Bob build only when the builder dependency is present.
Evidence against
- The logging hosts are the package's Paygreen payment service hosts.
- The inspected telemetry contains identifiers and error information, with no credentials or machine details.
- The prepare hook skips registry installs that lack the build dependency.
Behavioral surface
ChildProcessNetworkShell
UrlStrings
Source & flagged code
8 flaggedscripts/bob-if-present.jsView file
6}
L7: const { spawnSync } = require('node:child_process');
L8: const result = spawnSync('npx', ['bob', 'build'], { stdio: 'inherit', shell: true });
High
Child Process
Package source references child process execution.
scripts/bob-if-present.jsView on unpkg · L67const { spawnSync } = require('node:child_process');
L8: const result = spawnSync('npx', ['bob', 'build'], { stdio: 'inherit', shell: true });
L9: process.exit(result.status ?? 1);
High
7const { spawnSync } = require('node:child_process');
L8: const result = spawnSync('npx', ['bob', 'build'], { stdio: 'inherit', shell: true });
L9: process.exit(result.status ?? 1);
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/bob-if-present.jsView on unpkg · L7Findings
3 High6 Medium3 Low
HighChild Processscripts/bob-if-present.js
HighShellscripts/bob-if-present.js
HighRuntime Package Installscripts/bob-if-present.js
MediumNetwork
MediumAi Review Evidencesrc/log.ts
MediumAi Review Evidencesrc/log.ts
MediumAi Review Evidencesrc/log.ts
MediumAi Review Evidencesrc/index.ts
MediumStripped Provenance Metadatasrc/index.ts
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to @lemonway/terminal@0.1.0-beta.1.
See all versions of @lemonway/terminal for other recorded verdicts.
- Review the evidence and your use of @lemonway/terminal@0.1.0-beta.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.