@straion/cli@0.1.23
> **Note:** This CLI is currently in early access. Features may change and we appreciate your feedback. For questions or issues, please contact [support@straion.com](mailto:support@straion.com).
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe source tracks CLI command usage to PostHog during ordinary runtime, and I found no telemetry disclosure in the README. The reviewed tracking payload is limited to the command name and CLI version and is gated on a Straion user ID, so this is suspicious telemetry rather than malicious exfiltration.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running a CLI command after a Straion user ID is available.
Impact
Command usage is reported to the analytics service, creating an undisclosed runtime telemetry concern.
Mechanism
The command wrapper initializes an analytics client and tracks the command name and CLI version. An environment variable disables analytics.
AI rationale
The source tracks CLI command usage to PostHog during ordinary runtime, and I found no telemetry disclosure in the README. The reviewed tracking payload is limited to the command name and CLI version and is gated on a Straion user ID, so this is suspicious telemetry rather than malicious exfiltration.
Evidence
dist/audit-XpgVhULD.jsdist/automode-BM0thZfX.js
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI command wrapper initializes analytics and tracks a cli_command_executed event with the command name.
- The analytics client sends to https://eu.i.posthog.com by default; STRAION_ANALYTICS_DISABLED=1 disables it.
- Analytics events are sent only when a user ID is available and include the CLI version.
- The automode hook emits an organization rules index to the agent session as its intended feature.
Evidence against
- The package is a CLI for the Straion platform, and the executable imports its CLI entry point.
- The command telemetry carries the command name and CLI version; the reviewed tracking code does not show collection of command output or credentials.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/automode-BM0thZfX.jsView file
1!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L2: `)}displayWidth(e){return u(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandTe...
High
Child Process
Package source references child process execution.
dist/automode-BM0thZfX.jsView on unpkg · L112Expecting one of '${n.join(`', '`)}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e...
L13: - already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=e=>[e.name()].concat(e.aliases()),n=t(e).find(e=>this._findCommand(...
L14: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...
...
L18: `),this.outputHelp({error:!0}));let n=t||{},r=n.exitCode||1,i=n.code||`commander.error`;this._exit(r,i,e)}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in l.env...
L19: Expecting one of '${n.join(`', '`)}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/automode-BM0thZfX.jsView on unpkg · L12Findings
1 Critical6 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/commands-Ckf1DeK0.js
HighChild Processdist/automode-BM0thZfX.js
HighSame File Env Network Executiondist/automode-BM0thZfX.js
HighCommand Output Exfiltrationdist/automode-BM0thZfX.js
HighCross File Remote Execution Contextdist/automode-BM0thZfX.js
HighTrigger Reachable Command Output Exfiltrationdist/automode-BM0thZfX.js
HighSemantic Analysis Limiteddist/audit-XpgVhULD.js#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @straion/cli@0.1.23.
See all versions of @straion/cli for other recorded verdicts.
- Review the evidence and your use of @straion/cli@0.1.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.