@oked/copilot
OKed for GitHub Copilot CLI and VS Code. A preToolUse hook that holds risky agent tool calls for a human decision.
This report shows the evidence for @oked/copilot@0.6.25. 0 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe hook automatically sends hostname-bearing retention telemetry once per day without documenting it or providing a documented opt-out. This is suspicious runtime telemetry, not evidence of credential theft or malicious install behavior.
Static reason
No blocking static signals were detected.
Trigger
A paired installation runs the Copilot hook; when its daily heartbeat interval has elapsed, the hook sends a heartbeat before returning a local safe or warning decision.
Impact
The service can associate a machine hostname with the paired account for retention analytics.
Mechanism
The SDK posts the hostname and the OKed API key to the configured backend heartbeat endpoint. The default backend is api.oked.ai.
AI rationale
The hook automatically sends hostname-bearing retention telemetry once per day without documenting it or providing a documented opt-out. This is suspicious runtime telemetry, not evidence of credential theft or malicious install behavior.
Evidence
.lpm-dependency-evidence-883b3e6f-1f9f-4ea1-906d-15cc1b033348/0/npm-linux/dist/decide.js.lpm-dependency-evidence-883b3e6f-1f9f-4ea1-906d-15cc1b033348/1/npm-linux/dist/index.js~/.oked/heartbeat.json
Network endpoints1
api.oked.ai/api/v1/heartbeat (default; backend is configurable)
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The hook sends a presence heartbeat before its safe and warning fast paths, even when no approval is needed; it is throttled to once per day.
- The heartbeat sends the machine hostname with the API key to the configured backend. The default backend is api.oked.ai.
- The README documents other environment settings but does not disclose the hostname heartbeat or provide a documented opt-out.
Evidence against
- The heartbeat requires an API key and sends only the hostname in its body.
- The backend can be changed through OKED_BACKEND_URL or saved configuration.
- There is no install, preinstall, or postinstall script; prepublishOnly only builds.
Behavioral surface
EnvironmentVarsFilesystem
UrlStrings
Source & flagged code
3 flagged.lpm-dependency-evidence-883b3e6f-1f9f-4ea1-906d-15cc1b033348/0/npm-linux/dist/decide.jsView file
62// Presence ping (throttled to once/day on disk, never throws). Fired before
// the safe/warning fast-path return so installs that only ever run safe
// actions still register for retention. Bounded
Medium
Ai Review Evidence
The hook sends a presence heartbeat before its safe and warning fast paths, even when no approval is needed; it is throttled to once per day.
.lpm-dependency-evidence-883b3e6f-1f9f-4ea1-906d-15cc1b033348/0/npm-linux/dist/decide.jsView on unpkg · L62.lpm-dependency-evidence-883b3e6f-1f9f-4ea1-906d-15cc1b033348/1/npm-linux/dist/index.jsView file
330body: JSON.stringify({ hostname: hostname() }),
signal: AbortSignal.timeout(3000),
Medium
Ai Review Evidence
Findings
4 Medium4 Low
MediumEnvironment Vars
MediumAi Review Evidence.lpm-dependency-evidence-883b3e6f-1f9f-4ea1-906d-15cc1b033348/0/npm-linux/dist/decide.js
MediumAi Review Evidence.lpm-dependency-evidence-883b3e6f-1f9f-4ea1-906d-15cc1b033348/1/npm-linux/dist/index.js
MediumAi Review Evidence.lpm-dependency-evidence-883b3e6f-1f9f-4ea1-906d-15cc1b033348/1/npm-linux/dist/index.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @oked/copilot@0.6.25.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @oked/copilot@0.6.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.