@pawlogic/dl@0.39.0
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe update helper sends identifying user and project telemetry, and a snippet of npm error output, to a vendor callback endpoint when invoked in its hosted environment. That supports a telemetry warning; the manifest has no install hook, and the helper skips reporting if required callback credentials are absent.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The helper’s wrapper telemetry path runs when invoked and callback URL, proxy token, and curl are available.
Impact
The vendor callback service receives user and project identifiers and potentially revealing npm error details without an explicit telemetry opt-in shown in the package.
Mechanism
It posts update outcome data, identifiers drawn from injected environment variables and hostname, and a short npm error tail using the proxy token for authorization.
AI rationale
The update helper sends identifying user and project telemetry, and a snippet of npm error output, to a vendor callback endpoint when invoked in its hosted environment. That supports a telemetry warning; the manifest has no install hook, and the helper skips reporting if required callback credentials are absent.
Evidence
dl-npm-update.shdl.mjspackage.json
Network endpoints1
callback-server-z4umynwjcq-uc.a.run.app/sandbox-rpc/dl/selfupdate-event
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The update helper posts telemetry to the callback server when the callback URL and proxy token are present.
- The payload includes project, user, prompt, tool-call, and sandbox identifiers, plus up to 200 bytes of npm error output.
- The bundled CLI names the Actionway callback server as its default callback endpoint.
Evidence against
- The manifest declares CLI binaries but no lifecycle scripts.
- The helper skips telemetry when its callback URL or proxy token is absent.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedTrivialUrlStrings
NoLicense
Source & flagged code
8 flaggeddl.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @pawlogic/dl@0.38.1
matchedIdentity = npm:QHBhd2xvZ2ljL2Rs:0.38.1
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dl.mjsView on unpkg1#!/usr/bin/env node
L2: import e,{readFileSync as t,existsSync as i,mkdirSync as n,writeFileSync as o,chmodSync as r,realpathSync as a,rmSync as s,cpSync as c,constants as l}from"node:fs";import d,{dirnam...
High
1#!/usr/bin/env node
L2: import e,{readFileSync as t,existsSync as i,mkdirSync as n,writeFileSync as o,chmodSync as r,realpathSync as a,rmSync as s,cpSync as c,constants as l}from"node:fs";import d,{dirnam...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dl.mjsView on unpkg · L1Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadl.mjs
HighChild Processdl.mjs
HighSame File Env Network Executiondl.mjs
HighCommand Output Exfiltrationdl.mjs
HighSandbox Evasion Gated Capabilitydl.mjs
HighTrigger Reachable Command Output Exfiltrationdl.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdl-npm-update.sh
MediumStructural Risk Force Deep Review
LowEvaldl.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @pawlogic/dl@0.39.0.
See all versions of @pawlogic/dl for other recorded verdicts.
- Review the evidence and your use of @pawlogic/dl@0.39.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.