registry / @osm-conflation-engine/cli / 3.4.3
@osm-conflation-engine/cli@3.4.3
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest has no install hook, and the reviewed process and network operations are reached through the exported run() API for OSM downloads and conflation. OSM credentials are sent to OpenStreetMap for login and the resulting cookies are used for the requested extract; no unrelated credential destination or attack behavior was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer explicitly calls the exported run() API; download, match, and conflate are its default steps.
Impact
Expected data retrieval and processing for the package’s OSM conflation purpose; no credential flow to an unrelated host was found.
Mechanism
The API fetches OSM data, optionally authenticates to OpenStreetMap using OSM_AUTH, invokes curl to download a requested extract, and stores processing outputs in a temporary directory. In GitHub Actions it also updates run history at the package’s service.
AI rationale
The manifest has no install hook, and the reviewed process and network operations are reached through the exported run() API for OSM downloads and conflation. OSM credentials are sent to OpenStreetMap for login and the resulting cookies are used for the requested extract; no unrelated credential destination or attack behavior was identified.
Evidence
/tmp/oce-*/o.pbf/tmp/oce-*/ignore-list.json/tmp/oce-*/osm-processed-with-ref.jsonl/tmp/oce-*/osm-processed-no-ref.jsonl/tmp/oce-*/osm-processed-other.json
Network endpoints5
osm-internal.download.geofabrik.dewww.openstreetmap.orgosm-conflation-engine.kyle.kiwioverpass-api.dedownload.geofabrik.de
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports dist/index.cjs and dist/index.mjs, with no install lifecycle scripts.
- OSM_AUTH is optional; without it, the code warns and uses a public Geofabrik URL.
- When OSM_AUTH is present, its username and password are submitted to openstreetmap.org for login.
- The resulting cookies are used by curl to download the requested OSM extract.
- The package exposes run(); its download, match, and conflate steps are triggered by calling that API.
- In GitHub Actions, run history is sent to the package’s own service using an OIDC token scoped to osm-conflation-engine.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/index.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @osm-conflation-engine/cli@3.4.1
matchedIdentity = npm:[redacted]:3.4.1
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.cjsView on unpkg1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `);n.end(),await new Promise(e=>n.on(`finish`,e))}function D(e,t){let n=t||3;switch(e.type){case`GeometryCollection`:throw Error(`not supported`);case`Point`:return[(0,p.latLngToCe...
High
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Obje...
L2: `);n.end(),await new Promise(e=>n.on(`finish`,e))}function D(e,t){let n=t||3;switch(e.type){case`GeometryCollection`:throw Error(`not supported`);case`Point`:return[(0,p.latLngToCe...
Findings
2 Critical5 High2 Medium4 Low
CriticalManifest Confusionpackage.json
CriticalPrevious Version Dangerous Deltadist/index.cjs
HighChild Processdist/index.cjs
HighSame File Env Network Executiondist/index.cjs
HighCommand Output Exfiltrationdist/index.cjs
HighTrigger Reachable Command Output Exfiltrationdist/index.cjs
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @osm-conflation-engine/cli@3.4.3.
See all versions of @osm-conflation-engine/cli for other recorded verdicts.
- Review the evidence and your use of @osm-conflation-engine/cli@3.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.