@telemetry-tracker/core@1.5.3
Lightweight telemetry client: events, errors, sessions. Framework-agnostic core.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe SDK's normal session flow sends user_email to its configured ingest endpoint after identify() records an email, and client-side scrubbing is opt-in. This is identifying runtime telemetry, so it warrants a warning; the documented analytics purpose and app-triggered initialization do not establish malicious behavior.
Decision evidence
public snapshot- Calling init starts a session, which posts session data to the configured ingest URL.
- Session payloads include user_email when identify() has set an email; PII scrubbing is opt-in.
- The README describes the package as an error-tracking and product-analytics SDK.
- The app must call init to start telemetry, and supplies the ingest URL.
- No install lifecycle scripts are declared.
- The README documents telemetry as the package's purpose and shows its own service as the example endpoint.
Source & flagged code
6 flaggedCalling init starts a session, which posts session data to the configured ingest URL.
dist/index.jsView on unpkg · L309Calling init starts a session, which posts session data to the configured ingest URL.
Findings
Affected versions and remediation
This report applies to @telemetry-tracker/core@1.5.3.
See all versions of @telemetry-tracker/core for other recorded verdicts.
- Review the evidence and your use of @telemetry-tracker/core@1.5.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.