@nexushub/client@0.9.0
@nexushub/client has been rebranded to @gnapex/sdk. Please install @gnapex/sdk@^1.0.0.
The God-Tier NexusHub SDK
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package's browser entry starts collecting and transmitting analytics as a side effect of import, even though its documented opt-out is not implemented in the built client. This is a telemetry risk, but the inspected destination is the package's own analytics service and the package advertises analytics functionality.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Importing the SDK in a browser, before an application explicitly creates or configures a client.
Impact
Page URLs and search values, referrer, visitor/session identifiers, device context, and interaction details can be sent automatically. The README's documented opt-out is not applied by the built client.
Mechanism
The module instantiates a default client at import time; its browser constructor starts tracking page views and user interactions, queues events, and posts them with the configured project API key.
AI rationale
The package's browser entry starts collecting and transmitting analytics as a side effect of import, even though its documented opt-out is not implemented in the built client. This is a telemetry risk, but the inspected destination is the package's own analytics service and the package advertises analytics functionality.
Evidence
dist/index.cjsREADME.md
Network endpoints1
sentry.gnapex.com/api/collect
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Importing the SDK creates a default client; in browsers its constructor starts analytics immediately.
- Analytics startup sends a page view and installs automatic click, form, route, scroll, outbound-link, video, and error tracking.
- Event payloads include visitor/session identifiers and page context, then are POSTed with the project API key to the default analytics collector.
- The README says analytics starts when using NexusProvider and advertises a disableAnalytics prop, but the built client starts collection without checking that prop.
Evidence against
- Analytics is part of the package's stated CMS and analytics purpose, and the README describes automatic tracking.
- The default collector is the package's own analytics host; the inspected code does not send these events to an unrelated collector.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
6 flaggeddist/cli.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @nexushub/client@0.6.5
matchedIdentity = npm:QG5leHVzaHViL2NsaWVudA:0.6.5
similarity = 0.833
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.cjsView on unpkg25\r
L26: `),i=!1,a=!1,l;n.on("response",u=>{let{headers:p}=u;i=p["transfer-encoding"]==="chunked"&&!p["content-length"]}),n.on("socket",u=>{let p=()=>{if(i&&!a){let f=new Error("Premature c...
L27: \u{1F6A8} NexusHub Security Alert: Data Integrity Violation in file:
High
17`);return l!==-1&&(t=La(t,a,i,l)),i+t+a};Object.defineProperties(Xr.prototype,_r);var df=Xr(),sh=Xr({level:Ba?Ba.level:0});var E=df;var xr=Q(require("process"),1),rl=require("util"...
L18: ${t}`,yf=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),bf=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),_f=(n,t,o)=>{let i=o===""?"":`with ${...
L19: `),f=u-1;i=[...m.slice(0,f),"... (content truncated to fit terminal)"].join(`
...
L25: \r
L26: `),i=!1,a=!1,l;n.on("response",u=>{let{headers:p}=u;i=p["transfer-encoding"]==="chunked"&&!p["content-length"]}),n.on("socket",u=>{let p=()=>{if(i&&!a){let f=new Error("Premature c...
L27: \u{1F6A8} NexusHub Security Alert: Data Integrity Violation in file:
Findings
1 Critical5 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.cjs
HighChild Processdist/cli.cjs
HighSame File Env Network Executiondist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cli.cjs
HighRuntime Package Installdist/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nexushub/client@0.9.0.
See all versions of @nexushub/client for other recorded verdicts.
- Review the evidence and your use of @nexushub/client@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.