@readystack/rechnung-pflichtangaben-lint-de@1.0.3
Not affiliated with ReadyStack (readystack.dev). No new versions are published here. These tools continue under the name Rulestamp, by the team behind getreadystack.com.
Prüft PHP-Rechnungstemplates von WooCommerce- und WordPress-Shops gegen alle zehn Pflichtangaben des § 14 Abs. 4 UStG — 17 Regeln, Befunde mit Zeilennummer.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends undisclosed runtime telemetry on free scans, though the event contains only package-use metadata and has TTY and opt-out checks. License validation and the rules feed use the package's own paid-service flow, and no credential exfiltration or other attack was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A free CLI scan in an interactive terminal.
Impact
The publisher can count free CLI use. The event contains no apparent personal, project, or file data.
Mechanism
The CLI sends a small use event to getreadystack.com; TTY and opt-out checks limit when it sends.
AI rationale
The CLI sends undisclosed runtime telemetry on free scans, though the event contains only package-use metadata and has TTY and opt-out checks. License validation and the rules feed use the package's own paid-service flow, and no credential exfiltration or other attack was identified.
Evidence
cli.jslicense.jspath.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), 'rechnung-pflichtangaben-lint-de.json')
Network endpoints3
getreadystack.com/api/evgetreadystack.com/api/rules/api.polar.sh/v1/customer-portal/license-keys/validate
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package's CLI entrypoint is cli.js.
- After a free CLI run, the program calls pingUse automatically.
- pingUse sends an event containing only the package slug, CLI source, and free-use reason to getreadystack.com/api/ev; it runs in a TTY and can be disabled with the documented-in-code environment flags.
Evidence against
- The event contains no hostname, username, file contents, credentials, or project details.
- License validation sends the user's license key to Polar's license-validation endpoint.
- The package describes its paid folder scan and license key in the README, and no install lifecycle script is present.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedlicense.jsView file
2'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31: req.on('error', function () { resolve({ ok: false, offline:
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
license.jsView on unpkg · L22Trigger-reachable chain: manifest.bin -> cli.js -> license.js
L2: 'use strict';
L3: const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
L4: const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
...
L9: const RECHECK_MS = 7 * 24 * 3600 * 1000; // re-ask Polar every 7 days (refunds / cancellations)
L10: function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
L11: function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
L12: function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still work...
...
L31
Findings
2 Critical2 High4 Medium4 Low
CriticalCredential Exfiltrationlicense.js
CriticalTrigger Reachable Dangerous Capabilitylicense.js
HighSandbox Evasion Gated Capabilitylicense.js
HighTrigger Reachable Credential Exfiltrationlicense.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @readystack/rechnung-pflichtangaben-lint-de@1.0.3.
See all versions of @readystack/rechnung-pflichtangaben-lint-de for other recorded verdicts.
- Review the evidence and your use of @readystack/rechnung-pflichtangaben-lint-de@1.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.