@marinade.finance/validator-bonds-cli-core
Common CLI Core of the validator bonds contract
This report shows the evidence for @marinade.finance/validator-bonds-cli-core@3.0.0. 0 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package implements runtime Mixpanel telemetry that can report wallet identifiers, account activity, and transaction details without a disclosure found in the package. This warrants a warning for undisclosed runtime telemetry; the behavior is not install-time or import-time.
Decision evidence
public snapshot- When CLI usage is enabled, the pre-action hook records command data and wallet/account identifiers.
- Telemetry properties include the wallet public key or install ID, session and command details, and platform/runtime information.
- Command-completion events can include transaction signatures, amounts, and account addresses, and are posted to the Mixpanel proxy.
- A built-in Mixpanel token and default proxy enable reporting unless telemetry is disabled.
- The package declares no install or lifecycle scripts; its npm scripts are build and test tasks.
- Telemetry runs through the CLI action hook rather than during module import.
- The install ID is a random UUID stored under the user's config directory.
Source & flagged code
4 flaggedWhen CLI usage is enabled, the pre-action hook records command data and wallet/account identifiers.
dist/src/commands/mainCommand.jsView on unpkg · L91Telemetry properties include the wallet public key or install ID, session and command details, and platform/runtime information.
dist/src/cliUsage.jsView on unpkg · L158Findings
Affected versions and remediation
This report applies to @marinade.finance/validator-bonds-cli-core@3.0.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @marinade.finance/validator-bonds-cli-core@3.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.