@monster-orange/den@0.1.0
Den: a local multi-repo dev orchestrator, HTTPS edge and E2E harness
AI Security Review
scanned 15h ago · by lpm-firewall-aiThe package sends runtime telemetry containing a local username and Git repository details to Sentry by default, without documenting the collection in its README. This is suspicious telemetry; the Auth0 credential flows inspected use the configured Auth0 tenant for the package’s testing features.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Automatically when a CLI invocation exits; the server also imports the telemetry emitter.
Impact
A Sentry operator can associate CLI activity with a local username and repository details. No credential theft or unrelated account action was identified.
Mechanism
The emitter gathers Git user.name or USER, repository basename, branch, short SHA, and a hash of api-dependencies.yml, then sends event attributes to the host in the configured Sentry DSN. CI=true or DEV_METRICS_DISABLED=1 suppresses remote shipping.
AI rationale
The package sends runtime telemetry containing a local username and Git repository details to Sentry by default, without documenting the collection in its README. This is suspicious telemetry; the Auth0 credential flows inspected use the configured Auth0 tenant for the package’s testing features.
Evidence
src/shared/dev-metrics/emit.tssrc/ui/cli/index.ts<repoRoot>/.dev-metrics/events.jsonl
Network endpoints1
Host parsed from DEV_METRICS_SENTRY_DSN or the repository’s .stack/common-iac/scripts/lib/dev-metrics.config; no literal hostname is present in the source.
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Each CLI run records an event containing the local Git username, repository name, branch, and short commit SHA; it also reads api-dependencies.yml and includes a short hash.
- The CLI registers an exit handler that records an invocation for every run.
- Telemetry is sent to the host in a configured Sentry DSN by default; CI=true or DEV_METRICS_DISABLED=1 suppresses shipping.
- README.md does not disclose this telemetry or the opt-out.
Evidence against
- The Auth0 token code sends credentials to the Auth0 domain configured for the environment, consistent with the package’s testing and authentication features.
- The package’s prepare hook runs husky install; the inspected hook does not send data or modify agent configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedsrc/shared/environment-manager/derivation/cache.tsView file
57const raw = fs.readFileSync(CACHE_PATH, "utf-8");
L58: const parsed = JSON.parse(raw) as CacheFile;
L59: if (parsed.version !== CACHE_VERSION)
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/shared/environment-manager/derivation/cache.tsView on unpkg · L57src/shared/auth/token-providers/auth0.tsView file
40L41: const body: Record<string, string> = {
L42: grant_type: "password",
...
L47: client_id: clientId,
L48: realm: process.env.E2E_AUTH0_REALM ?? "Username-Password-Authentication",
L49: };
...
L57:
L58: const response = await fetch(`https://${domain}/oauth/token`, {
L59: method: "POST",
...
L64:
L65: const data = (await response.json()) as RopcResponse;
L66:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
src/shared/auth/token-providers/auth0.tsView on unpkg · L40Findings
1 Critical1 High4 Medium6 Low
CriticalCredential Exfiltrationsrc/shared/auth/token-providers/auth0.ts
HighSemantic Analysis Limitedbin/den
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpermake/demo.mk
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptosrc/shared/environment-manager/derivation/cache.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @monster-orange/den@0.1.0.
See all versions of @monster-orange/den for other recorded verdicts.
- Review the evidence and your use of @monster-orange/den@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.