registry / @lotics/cli / 0.318.23
@lotics/cli@0.318.23
Lotics SDK and CLI for AI agents
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe suspicious scanner leads resolve to ordinary CLI behavior: an explicit update path, Lotics API requests, and opt-in disclosed telemetry. I found no automatic credential redirection or host-identity exfiltration in the inspected entry points.
Static reason
One or more suspicious static signals were detected.
Trigger
A user explicitly runs CLI commands; telemetry is recorded only when LOTICS_TELEMETRY=1 is set.
Impact
No evidence of credential redirection, host fingerprint exfiltration, or automatic command-output exfiltration was found.
Mechanism
The CLI sends API requests to the configured Lotics service. Opt-in telemetry queues command metadata and failure messages for that same service. API-key setup sends a user-provided key to the selected API URL for verification.
AI rationale
The suspicious scanner leads resolve to ordinary CLI behavior: an explicit update path, Lotics API requests, and opt-in disclosed telemetry. I found no automatic credential redirection or host-identity exfiltration in the inspected entry points.
Evidence
~/.lotics/session.json~/.lotics/telemetry-<host>.ndjson~/.lotics/config.json
Network endpoints4
api.lotics.airegistry.npmjs.org/@lotics/cli/latestlotics.ai/install.shlotics.ai/install.ps1
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and library entry point, with `prepublishOnly` running a build and no install-time script.
- Runtime telemetry is disabled unless `LOTICS_TELEMETRY=1` is set.
- Telemetry records command metadata and argument shape/hash rather than argument values; its documented behavior includes a failure message.
- The CLI sends requests to the Lotics API by default, or to the API URL the user configures.
- API-key setup prompts for a key and uses it with the selected API URL.
Evidence against
- The CLI includes a command string that pipes the official Lotics installer into a shell; it is part of the update flow, not an install hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/src/cli.jsView file
1791// src/cli_dispatch.ts
L1792: import { spawn as spawn2 } from "node:child_process";
L1793:
High
1824// docs/cli_reference.md
L1825: var cli_reference_default = "# @lotics/cli \u2014 CLI Command Reference\n\nPer-command syntax, flags, contracts, and gotchas for the public `lotics` CLI. Start at [AGENTS.md](../AG...
L1826:
High
9// src/cli.ts
L10: import dns from "node:dns";
L11: import net from "node:net";
...
L111: import path from "node:path";
L112: function telemetryEnabled(env = process.env) {
L113: return env.LOTICS_TELEMETRY === "1";
...
L142: function sessionStorePath() {
L143: return path.join(os.homedir(), ".lotics", "session.json");
L144: }
...
L146: try {
L147: const parsed = JSON.parse(fs.readFileSync(file2, "utf-8"));
L148: if (typeof parsed !== "object" || parsed === null) return null;
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
Findings
6 High3 Medium6 Low
HighChild Processdist/src/cli.js
HighShelldist/src/cli.js
HighHost Fingerprint Exfiltrationdist/src/cli.js
HighCredential Redirect Persistencedist/src/cli.js
HighCommand Output Exfiltrationdist/src/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/src/cli.js
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @lotics/cli@0.318.23.
See all versions of @lotics/cli for other recorded verdicts.
- Review the evidence and your use of @lotics/cli@0.318.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.