registry / @osm-conflation-engine/cli / 3.1.0
@osm-conflation-engine/cli@3.1.0
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe flagged network, environment, and subprocess primitives implement an explicit OSM conflation download workflow, not install-time or covert behavior. The configurable PBF URL cookie forwarding is a design risk for untrusted configurations, but source inspection does not establish malicious package behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Explicit consumer call to `run()` with the download step and configured OSM data source.
Impact
No install-time execution, persistence, broad filesystem mutation, or unsolicited exfiltration was found; a user-selected PBF URL receives the session cookie produced for that explicit download flow.
Mechanism
User-configured OSM download, optional OSM_AUTH login, and local conflation processing.
AI rationale
The flagged network, environment, and subprocess primitives implement an explicit OSM conflation download workflow, not install-time or covert behavior. The configurable PBF URL cookie forwarding is a design risk for untrusted configurations, but source inspection does not establish malicious package behavior.
Evidence
package.jsondist/index.mjs.mapdist/index.d.mtsdist/index.mjs
Network endpoints5
osm-conflation-engine.kyle.kiwioverpass-api.de/api/interpreterosm-internal.download.geofabrik.dedownload.geofabrik.dewww.openstreetmap.org
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- `dist/index.mjs.map` contains user-invoked OSM_AUTH login and passes the resulting cookie to the configured PBF URL.
- `dist/index.mjs.map` spawns `curl`, but with a fixed executable and argument array rather than a shell.
Evidence against
- `package.json` has no preinstall, install, postinstall, or other lifecycle hook.
- `package.json` exposes a library entrypoint and declares no `bin` executable.
- `dist/index.mjs.map` shows all network activity occurs only inside exported `run()` download processing.
- `dist/index.mjs.map` writes intermediates beneath a deterministic subdirectory of the system temp directory.
- No eval/vm/dynamic loading, persistence, destructive system actions, or AI-agent control-surface paths were found.
- Known fetches target OSM, Geofabrik, Overpass, and the package-aligned ignore-list API.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
4 flaggeddist/index.cjsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `);n.end(),await new Promise(e=>n.on(`finish`,e))}function O(e,t){let n=t||3;switch(e.type){case`GeometryCollection`:throw Error(`not supported`);case`Point`:return[(0,p.latLngToCe...
High
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `);n.end(),await new Promise(e=>n.on(`finish`,e))}function O(e,t){let n=t||3;switch(e.type){case`GeometryCollection`:throw Error(`not supported`);case`Point`:return[(0,p.latLngToCe...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.cjsView on unpkg · L11Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `);n.end(),await new Promise(e=>n.on(`finish`,e))}function O(e,t){let n=t||3;switch(e.type){case`GeometryCollection`:throw Error(`not supported`);case`Point`:return[(0,p.latLngToCe...
...
L5: out meta center;
L6: `,i=t?await u.promises.readFile(t,`utf8`):r;console.info(`fetching OSM data via overpass…`);let a=await fetch(`${n||`https://overpass-api.de/api/interpreter`}?data=${encodeURICompo...
Findings
1 Critical3 High2 Medium4 Low
CriticalManifest Confusionpackage.json
HighChild Processdist/index.cjs
HighSame File Env Network Executiondist/index.cjs
HighCommand Output Exfiltrationdist/index.cjs
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @osm-conflation-engine/cli@3.1.0.
See all versions of @osm-conflation-engine/cli for other recorded verdicts.
- Review the evidence and your use of @osm-conflation-engine/cli@3.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.