registry / Data exfiltration / @ngocsangairvds/vsaf
@ngocsangairvds/vsaf
is it ready to use ?
This report shows the evidence for @ngocsangairvds/vsaf@6.15.0. 2 of 35 known versions are blocked or flagged. The newest version, 6.19.0, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package embeds credentials and automatically configures authenticated telemetry that exports identifying workflow metadata to a fixed external service. This is concrete data exfiltration, despite activation occurring through the package's explicit CLI workflow.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
User runs `vsaf init`, then runs a VSAF workflow.
Impact
Unconsented disclosure of workflow arguments and user/session identifiers to a package-controlled endpoint.
Mechanism
Bundled authenticated OTLP telemetry exports run metadata.
Attack narrative
After a user initializes a project, the package copies bundled Langfuse settings, including embedded credentials, into the project telemetry configuration. On later workflow execution it creates authenticated OTLP exports containing workflow arguments (up to 4096 characters), run identifiers, Claude session IDs, and user IDs. The behavior is not npm-install-time, but it is a concrete default telemetry exfiltration path enabled by the package rather than an endpoint supplied by the user.
AI rationale
The package embeds credentials and automatically configures authenticated telemetry that exports identifying workflow metadata to a fixed external service. This is concrete data exfiltration, despite activation occurring through the package's explicit CLI workflow.
Evidence
telemetry.defaults.jsonpackages/cli/dist/commands/init.jspackages/cli/dist/telemetry/config.jspackages/cli/dist/telemetry/otel-tracer.jspackages/cli/dist/telemetry/otel-sdk.js.vsaf/config.yaml.claude/settings.json.vsaf/.claude-session
Network endpoints1
langfuse.viettel.digital/api/public/otel/v1/traces
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Bundled telemetry defaults name langfuse.viettel.digital and include hard-coded Langfuse credentials.
- `vsaf init` writes bundled telemetry defaults into project config without an opt-in prompt.
- Configured telemetry derives a Langfuse OTLP endpoint with Basic authentication.
- Run traces export workflow arguments, Claude session ID, and user ID to the configured endpoint.
Evidence against
- The npm postinstall only creates a local node_modules/@vsaf/core symlink.
- Claude hook and skill writes are activated by explicit CLI setup commands, not npm lifecycle execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedProtestwareUrlStrings
Source & flagged code
21 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node -e "const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd...
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file
194patternName = aws_access_key
severity = critical
line = 194
matchedText = - AKIA12... key
Findings
5 Critical13 High8 Medium5 Low
CriticalCritical Secretskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py
CriticalSecret Patternskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py
CriticalSecret Patternskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py
CriticalSecret Patternskills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh
CriticalSecret Patternskills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processpackages/core/dist/isolation/workspace-manager.js
HighShell
HighRuntime Package Installskills/sdlc/install-deps.mjs
HighShips High Entropy Blobskills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf
Affected versions and remediation
This report applies to @ngocsangairvds/vsaf@6.15.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ngocsangairvds/vsaf@6.15.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.