registry / @tekdi/coding-analytics / 1.0.5
@tekdi/coding-analytics@1.0.5
Monitor Cursor & Claude Code usage and send analytics to PostHog. Uses hooks to capture events.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
1 flaggeddist/install-service.jsView file
39const os = __importStar(require("os"));
L40: const child_process_1 = require("child_process");
L41: const config_1 = require("./config");
...
L65: constructor() {
L66: this.cursorHooksDir = path.join(os.homedir(), '.cursor');
L67: this.cursorHooksPath = path.join(this.cursorHooksDir, 'hooks.json');
...
L77: try {
L78: settings = JSON.parse(fs.readFileSync(this.cursorHooksPath, 'utf-8'));
L79: }
...
L186: try {
L187: existing = (0, child_process_1.execSync)('crontab -l 2>/dev/null').toString();
L188: }
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/install-service.jsView on unpkg · L39Findings
3 Medium6 Low
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/install-service.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @tekdi/coding-analytics@1.0.5.
See all versions of @tekdi/coding-analytics for other recorded verdicts.
- Review the evidence and your use of @tekdi/coding-analytics@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.