When the P4Code CLI server runs, it reads an identifier from a foreign AI-client authentication file and transmits its hash with telemetry. No install-time execution was found.
Running the p4c CLI server with telemetry enabled.
Impact
A third party can correlate P4Code usage telemetry with a stable identifier derived from another AI tool's local account data.
Mechanism
Default telemetry derives a tracking identifier from Codex or Claude account metadata and posts event batches.
Rationale
This is not an install-hook attack, but default tracking based on another tool's authentication metadata is a concrete privacy and data-exfiltration concern. The identifier is hashed and runtime-triggered, so a warning is proportionate rather than a publication block.
Evidence
dist/bin.mjs~/.codex/auth.json~/.claude.json
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshot
AI called this Suspicious at 90.0% confidence as Unknown with low false-positive risk.
Evidence for warning
The CLI reads the account identifier from the user's Codex authentication file for telemetry.
Telemetry is enabled by default and sends a hashed identifier, event data, platform, architecture, and version to PostHog.
This is a concrete third-party identity-tracking data flow, although it does not send the authentication token itself.
Evidence against
package.json has no preinstall, install, postinstall, or other lifecycle script.
The code extracts only account_id, hashes it with SHA-256, and the network activity occurs when the CLI server runs.
1import{t as e}from"./javascript-CUt1pgmJ.js";import{t}from"./css-DJp_X0uY.js";import{t as n}from"./html-C8UlPnhE.js";import{t as r}from"./xml-DIqSwXR3.js";import{t as i}from"./json...
L2: //# sourceMappingURL=blade-llJRbbtR.js.map
High
Child Process
Package source references child process execution.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L240: //#endregion
L241: //#region package.json
L242: var version = "0.4.0";
...
L375: /**
L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L377: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Sensitive Archive Exfiltration
Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L240: //#endregion
L241: //#region package.json
L242: var version = "0.4.0";
...
L375: /**
L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L377: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
13Trigger-reachable chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L240: //#endregion
L241: //#region package.json
L242: var version = "0.4.0";
...
L375: /**
L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L377: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin.mjs:
import * as NodeReadline from "node:readline";
}).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore);
var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", {
baseUrl: Schema$1.String
authorization: Schema$1.optionalKey(Schema$1.String),
httpBaseUrl: TrimmedNonEmptyString,
wsBaseUrl: TrimmedNonEmptyString,
httpBaseUrl: Schema$1.NullOr(Schema$1.String),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L240: //#endregion
L241: //#region package.json
L242: var version = "0.4.0";
...
L375: /**
L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L377: * on Windows). Node joins the command and arguments with spaces and hands the
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
21import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L3682: name: TrimmedNonEmptyString,
L3683: baseUrl: Schema$1.String
L3684: });
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
13Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L240: //#endregion
L241: //#region package.json
L242: var version = "0.4.0";
...
L375: /**
L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L377: * on Windows). Node joins the command and arguments with spaces and hands the
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
1import{t as e}from"./javascript-CUt1pgmJ.js";import{t}from"./css-DJp_X0uY.js";import{t as n}from"./html-C8UlPnhE.js";import{t as r}from"./xml-DIqSwXR3.js";import{t as i}from"./json-Bg9ijW3F.js";import a from"./html-derivative-CY6NRz-J.js";import{t as o}from"./sql-DNssxck8.js";var s=Object.freeze(JSON.parse(`{"displayName":"Blade","fileTypes":["blade.php"],"foldingStartMarker":"(/\\\\*|\\\\{\\\\s*$|<<<HTML)","foldingStopMarker":"(\\\\*/|^\\\\s*}|^HTML;)","injections":{"text.html.php.blade - (meta.embedded | meta.tag | comment.block.blade), L:(text.html.php.blade meta.tag - (comment.block.blade ...
2//# sourceMappingURL=blade-llJRbbtR.js.map
High
Child Process
Package source references child process execution.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L240: //#endregion
L241: //#region package.json
L242: var version = "0.4.0";
...
L375: /**
L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L377: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Sensitive Archive Exfiltration
Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L240: //#endregion
L241: //#region package.json
L242: var version = "0.4.0";
...
L375: /**
L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L377: * on Windows). Node joins the command and arguments with spaces and hands the
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
13Trigger-reachable chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L240: //#endregion
L241: //#region package.json
L242: var version = "0.4.0";
...
L375: /**
L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L377: * on Windows). Node joins the command and arguments with spaces and hands the
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/bin.mjs:
import * as NodeReadline from "node:readline";
}).pipe(Effect.flatMap((encoded) => fs.writeFileString(cachePath, encoded)), Effect.ignore);
var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", {
baseUrl: Schema$1.String
authorization: Schema$1.optionalKey(Schema$1.String),
httpBaseUrl: TrimmedNonEmptyString,
wsBaseUrl: TrimmedNonEmptyString,
httpBaseUrl: Schema$1.NullOr(Schema$1.String),
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
13import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L240: //#endregion
L241: //#region package.json
L242: var version = "0.4.0";
...
L375: /**
L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L377: * on Windows). Node joins the command and arguments with spaces and hands the
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
21import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L3682: name: TrimmedNonEmptyString,
L3683: baseUrl: Schema$1.String
L3684: });
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
13Trigger-reachable credential exfiltration chain: manifest.bin -> dist/bin.mjs
L13: import * as NodeOS from "node:os";
L14: import * as NodeNet from "node:net";
L15: import * as Data from "effect/Data";
...
L21: import * as NodePath from "node:path";
L22: import * as NodeChildProcess from "node:child_process";
L23: import * as NodeFS from "node:fs";
...
L240: //#endregion
L241: //#region package.json
L242: var version = "0.4.0";
...
L375: /**
L376: * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
L377: * on Windows). Node joins the command and arguments with spaces and hands the
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.