@optimuslabs/discovery-staging@0.4.8
Shadow AI Discovery — daily heuristic scan for AI agents on macOS endpoints; writes a local JSON report.
AI Security Review
scanned 12h ago · by lpm-firewall-aiThe CLI uploads endpoint inventory and identifying details by default, contradicting the README's local-only description. The destination is the package's own configurable service and the scanned data supports its discovery feature, so this warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
When the macOS CLI runs and a scan is due; the TTL and skip settings can suppress a run.
Impact
The service receives identifiable endpoint inventory despite documentation describing the report as local-only.
Mechanism
The CLI scans for AI-agent artifacts, writes a local report, then uploads it with hardware UUID, hostname, username, and findings. The README says network transport is not implemented.
AI rationale
The CLI uploads endpoint inventory and identifying details by default, contradicting the README's local-only description. The destination is the package's own configurable service and the scanned data supports its discovery feature, so this warrants a warning rather than a malicious verdict.
Evidence
README.mddist/index.jsdist/upload.js.lpm-dependency-evidence-0206613d-d760-4911-80be-590d8ca82341/0/npm-linux/dist/endpoint-config.js~/.optimuslabs/management/discovery/latest-report.json~/.optimuslabs/management/discovery/history/<date>.json~/.optimuslabs/management/auth/auth_key.txt
Network endpoints1
app.optimuslabs.io/ (default; endpoint can be configured)
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- README.md says the scan performs no network I/O and that backend transport ships later.
- The CLI wires uploadDiscoveryReport into its run path without a separate upload opt-in.
- The upload payload includes the hardware UUID, hostname, username, and discovery report, then sends a POST request.
Evidence against
- The default destination is the Optimus service, and the base URL can be configured.
- The credential-pattern scan records a key type and file path as a finding; it does not include the matched key value.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
NoLicense
Source & flagged code
4 flaggeddist/discover.jsView file
15*/
L16: import { execFileSync, spawnSync } from "node:child_process";
L17: import fs from "node:fs";
High
dist/upload.jsView file
68export function resolveHardwareUuid() {
L69: const fromEnv = process.env.OPTIMUS_HARDWARE_UUID?.trim();
L70: if (fromEnv)
L71: return fromEnv;
L72: const ioregOutput = execSync("ioreg -rd1 -c IOPlatformExpertDevice", {
L73: encoding: "utf8",
...
L81: async function postJsonForAuth(endpointUrl, body) {
L82: const res = await fetch(endpointUrl, {
L83: method: "POST",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/upload.jsView on unpkg · L68vendor/rg/darwin-x64/rgView file
Findings
4 High4 Medium5 Low
HighChild Processdist/discover.js
HighShell
HighSame File Env Network Executiondist/upload.js
HighSemantic Analysis Limiteddist/index.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryvendor/rg/darwin-x64/rg
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @optimuslabs/discovery-staging@0.4.8.
See all versions of @optimuslabs/discovery-staging for other recorded verdicts.
- Review the evidence and your use of @optimuslabs/discovery-staging@0.4.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.