@solazah/solazah-cloud-runtime@0.2.69
Solazah 云端运行时：由 solazah-cli serve 拉起的执行端
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has a benign asset-validation postinstall hook, but its runtime usage telemetry sends account and device identifiers to the vendor’s GlitchTip service. The setting-based opt-out and limited event payloads reduce the risk, but identifying details in runtime telemetry warrant a warning.
Decision evidence
public snapshot- Usage telemetry sends the bound account name and device ID with activity events to the package’s GlitchTip service; account and device identifiers make this runtime telemetry suspicious under the review rules.
- The postinstall hook checks for bundled platform assets and sets the bundled ripgrep executable bit; it contains no network or data collection behavior.
- Usage reporting checks a setting and can be disabled; the inspected event descriptions say command names and user payloads are excluded.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references dynamic require/import behavior.
app/scripts/plugin-agent.jsFindings
Affected versions and remediation
This report applies to @solazah/solazah-cloud-runtime@0.2.69.
See all versions of @solazah/solazah-cloud-runtime for other recorded verdicts.
- Review the evidence and your use of @solazah/solazah-cloud-runtime@0.2.69 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.