@ohos-ports/treehouses-cli@1.26.23-beta.0
Thin command-line interface for Raspberry Pi low level configuration.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThis is a suspicious package because its root lifecycle scripts modify system paths and its feedback command sends identifying host and device details to a hard-coded webhook without clearly disclosing those fields. The available source does not show that this data is sent automatically during installation or import.
Decision evidence
public snapshot- When installed as root, postinstall creates a system bash-completion symlink; postuninstall can also remove /etc/treehouses.conf.
- The feedback command sends the host name, public IP address, device and software details, and the submitted message to a hard-coded Discord webhook.
- The package describes itself as a Raspberry Pi configuration CLI, and its feedback feature is intended to share feedback with developers.
- The CLI exposes the feedback command for an explicit user request; no evidence found that the webhook is contacted automatically on import or install.
Source & flagged code
8 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgWhen installed as root, postinstall creates a system bash-completion symlink; postuninstall can also remove /etc/treehouses.conf.
package.jsonView on unpkg · L18Findings
Affected versions and remediation
This report applies to @ohos-ports/treehouses-cli@1.26.23-beta.0.
See all versions of @ohos-ports/treehouses-cli for other recorded verdicts.
- Review the evidence and your use of @ohos-ports/treehouses-cli@1.26.23-beta.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.