registry / @nexushub/client / 1.1.1
@nexushub/client@1.1.1
@nexushub/client has been rebranded to @gnapex/sdk. Please install @gnapex/sdk@^1.0.0.
GN-Apex zero-config production runtime SDK
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe reported command execution and network behavior belongs to user-invoked project management and deployment commands. Browser tracking is part of the analytics SDK and uses its configured analytics endpoint; no unrelated credential collection or automatic install-time transfer was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Analytics begins when an application instantiates the SDK in a browser; deployment runs when a user invokes the CLI deploy command.
Impact
Expected analytics collection and project deployment; no automatic credential theft or unrelated data transfer was identified.
Mechanism
The SDK sends analytics to its configured analytics endpoint. The CLI packages project files and transfers them as part of a requested deployment.
AI rationale
The reported command execution and network behavior belongs to user-invoked project management and deployment commands. Browser tracking is part of the analytics SDK and uses its configured analytics endpoint; no unrelated credential collection or automatic install-time transfer was found.
Evidence
.apex-deploy-<timestamp>.tar.gz
Network endpoints2
api.gnapex.comsentry.gnapex.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes JavaScript SDK entry points and a separate CLI binary.
- Browser analytics starts when the SDK is instantiated with tracking enabled; the configuration supports disabling it.
- The CLI’s deployment packaging excludes common environment files, and deployment is an explicit command.
- CLI commands such as pull and push are registered as user-invoked actions.
Evidence against
- The SDK sends analytics to its configured analytics endpoint and defaults browser tracking on.
- The deploy command packages project files for upload, which can include files outside the listed exclusions.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/cli.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @nexushub/client@0.6.5
matchedIdentity = npm:QG5leHVzaHViL2NsaWVudA:0.6.5
similarity = 0.389
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.cjsView on unpkg13(Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L14: (Did you mean ${n[0]}?)`:""}ox.suggestSimilar=o8});var fx=B(Uc=>{"use strict";var a8=require("events").EventEmitter,$c=require("child_process"),Kr=require("path"),ia=require("fs"),...
L15: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma...
High
16Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(r):this._lifeCycleHooks[e]=[r],this}exitOverride(e){return e?this._exitCallback=e...
L17: - already used by option '${r.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let r=i=>[i.name()].concat(i.aliases()),n=r(e).find(i=>this._findCommand(...
L18: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...
...
L26: Expecting one of '${n.join("', '")}'`);let i=`${e}Help`;return this.on(i,s=>{let a;typeof r=="function"?a=r({error:s.error,command:s.command}):a=r,a&&s.write(`${a}
L27: `)}),this}_outputHelpIfRequested(e){let r=this._getHelp
Findings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.cjs
HighChild Processdist/cli.cjs
HighSame File Env Network Executiondist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cli.cjs
MediumDynamic Requiredist/react.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nexushub/client@1.1.1.
See all versions of @nexushub/client for other recorded verdicts.
- Review the evidence and your use of @nexushub/client@1.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.