@optimuslabs/discovery-staging
Shadow AI Discovery — daily heuristic scan for AI agents on macOS endpoints; writes a local JSON report.
This report shows the evidence for @optimuslabs/discovery-staging@0.4.8. 0 of 6 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 12h ago · by lpm-firewall-aiThe CLI uploads endpoint inventory and identifying details by default, contradicting the README's local-only description. The destination is the package's own configurable service and the scanned data supports its discovery feature, so this warrants a warning rather than a malicious verdict.
Decision evidence
public snapshot- README.md says the scan performs no network I/O and that backend transport ships later.
- The CLI wires uploadDiscoveryReport into its run path without a separate upload opt-in.
- The upload payload includes the hardware UUID, hostname, username, and discovery report, then sends a POST request.
- The default destination is the Optimus service, and the base URL can be configured.
- The credential-pattern scan records a key type and file path as a finding; it does not include the matched key value.
Source & flagged code
4 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/upload.jsView on unpkg · L68Findings
Affected versions and remediation
This report applies to @optimuslabs/discovery-staging@0.4.8.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @optimuslabs/discovery-staging@0.4.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.