registry / @nexushub/client / 1.1.0
@nexushub/client@1.1.0
@nexushub/client has been rebranded to @gnapex/sdk. Please install @gnapex/sdk@^1.0.0.
GN-Apex zero-config production runtime SDK
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package’s runtime collection is browser analytics described in its README, and the implementation provides settings to disable it. The flagged package installation and process execution occur in CLI setup flows rather than automatically during installation or import.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Analytics runs when an application creates the browser client, unless autoTracking or privacy.analytics is false. CLI setup actions require invoking a command.
Impact
Expected analytics collection for the SDK’s stated purpose; no unauthorized credential collection or unrelated execution was identified.
Mechanism
The browser tracker sends analytics events and session or visitor identifiers to the configured analytics endpoint. The CLI can install project dependencies during its setup workflow.
AI rationale
The package’s runtime collection is browser analytics described in its README, and the implementation provides settings to disable it. The flagged package installation and process execution occur in CLI setup flows rather than automatically during installation or import.
Evidence
dist/index.jsdist/cli.cjspackage.jsonREADME.md
Network endpoints2
api.gnapex.comsentry.gnapex.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes the SDK through its main exports and the CLI as a separately invoked `nexus` command.
- The README describes the browser SDK’s automatic analytics behavior, including page views, interaction events, Web Vitals and session identity.
- Analytics starts only in a browser client when tracking and analytics privacy settings have not been disabled; both settings can turn it off.
- The tracker sends project and anonymous/session identifiers, page URL, referrer, browser details and event data to its configured analytics endpoint.
- The SDK defaults analytics to GN-Apex’s service and supports runtime or environment overrides for the endpoint.
- The CLI’s package installation command is part of its explicit setup flow; no install lifecycle hook is declared.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
7 flaggeddist/cli.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @nexushub/client@0.6.5
matchedIdentity = npm:QG5leHVzaHViL2NsaWVudA:0.6.5
similarity = 0.389
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.cjsView on unpkg13(Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L14: (Did you mean ${n[0]}?)`:""}Jh.suggestSimilar=Gw});var rx=k(Lc=>{"use strict";var zw=require("events").EventEmitter,Oc=require("child_process"),zr=require("path"),Xo=require("fs"),...
L15: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma...
High
16Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(r):this._lifeCycleHooks[e]=[r],this}exitOverride(e){return e?this._exitCallback=e...
L17: - already used by option '${r.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let r=i=>[i.name()].concat(i.aliases()),n=r(e).find(i=>this._findCommand(...
L18: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...
...
L26: Expecting one of '${n.join("', '")}'`);let i=`${e}Help`;return this.on(i,s=>{let a;typeof r=="function"?a=r({error:s.error,command:s.command}):a=r,a&&s.write(`${a}
L27: `)}),this}_outputHelpIfRequested(e){let r=this._getHelp
Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.cjs
HighChild Processdist/cli.cjs
HighSame File Env Network Executiondist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cli.cjs
HighRuntime Package Installdist/cli.cjs
MediumDynamic Requiredist/local-cache-server-AMGC6BOZ.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @nexushub/client@1.1.0.
See all versions of @nexushub/client for other recorded verdicts.
- Review the evidence and your use of @nexushub/client@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.