@tekdi/coding-analytics@1.0.6
Monitor Cursor & Claude Code usage and send analytics to PostHog. Uses hooks to capture events.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe analytics purpose and explicit hook installation are legitimate, but the shipped defaults enable response-text capture while the README says responses are not captured by default. This disclosure mismatch makes the runtime telemetry suspicious.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After a user runs `coding-analytics install-hooks`, the configured editor hooks collect events and the installed cron flushes them every five minutes.
Impact
User prompts, tool inputs, and assistant response or thinking text may be transmitted despite the README’s claim about response capture defaults.
Mechanism
Hook handlers queue prompt, tool-input, response, and thinking fields according to capture settings; the batcher sends events to the configured PostHog host.
AI rationale
The analytics purpose and explicit hook installation are legitimate, but the shipped defaults enable response-text capture while the README says responses are not captured by default. This disclosure mismatch makes the runtime telemetry suspicious.
Evidence
dist/config.jsdist/claude-hooks-receiver.jsdist/hooks-listener.jsdist/batcher.jsdist/cli.jsdist/install-service.jsREADME.md~/.cursor/hooks.json~/.claude/settings.json~/.coding-analytics/config.json~/.coding-analytics/queue.jsonluser crontab
Network endpoints1
eu.i.posthog.com (default; configurable)
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package describes itself as capturing Cursor and Claude Code events for PostHog analytics.
- Hook and cron setup runs through the explicit `coding-analytics install-hooks` command.
- Shipped config defaults enable prompt, response, and agent-thinking capture.
- Hook handlers include configured response text and tool inputs in queued events.
- The README sample disables response capture and says AI response content is not captured by default, contrary to the shipped default.
- Events are sent using the configured PostHog API key and host.
Evidence against
- Analytics collection and PostHog transmission match the package’s stated purpose.
- The hooks and scheduled flush are installed only when the user runs the install command.
- The PostHog destination is configurable, and file-content capture defaults to false.
- The README describes secret redaction and hashed or opaque user IDs.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
6 flaggeddist/event-id.jsView file
56function uuidv5(name, namespace = NAMESPACE) {
L57: const nsBytes = Buffer.from(namespace.replace(/-/g, ''), 'hex');
L58: const hash = crypto.createHash('sha1').update(nsBytes).update(Buffer.from(name, 'utf-8')).digest();
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/event-id.jsView on unpkg · L56dist/install-service.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
"use strict";
var __createbinding = (this && this.__createbinding) || (object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = object.getownpropertydescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esmodule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
object.defineproperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setmoduledefault = (this && this.__setmoduledefault) || (object.create ? (function(o, v) {
object.defineproperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
High
Trigger Reachable External Ai Agent Control Surface Mutation
Findings
4 High3 Medium7 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-service.js
HighTrigger Reachable Persistencedist/install-service.js
HighSemantic Analysis Limiteddist/analysis/feedback-aggregator.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/enricher.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/install-service.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/event-id.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @tekdi/coding-analytics@1.0.6.
See all versions of @tekdi/coding-analytics for other recorded verdicts.
- Review the evidence and your use of @tekdi/coding-analytics@1.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.