@trayai/helix-cli@0.112.0
Helix CLI — helix init, helix dev, helix auth
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe analytics endpoint and purpose are disclosed, but the payload includes a project name derived from the `helix init` argument, conflicting with the changelog’s statement that command arguments are excluded. This is a limited runtime telemetry concern, not evidence of credential theft or malware.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a tracked CLI command such as `helix init` while logged in; `DO_NOT_TRACK=1` or `true` suppresses reporting.
Impact
A user-supplied project name or directory-derived name is disclosed to Tray as analytics data beyond the stated exclusion of command arguments.
Mechanism
The CLI sends event metadata and project fields, including `projectName`, to the environment-selected Tray API endpoint using the saved Tray session token.
AI rationale
The analytics endpoint and purpose are disclosed, but the payload includes a project name derived from the `helix init` argument, conflicting with the changelog’s statement that command arguments are excluded. This is a limited runtime telemetry concern, not evidence of credential theft or malware.
Evidence
dist/cli.jsCHANGELOG.md
Network endpoints1
Environment-selected Tray API base URL: private/v1/helix/analytics
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI posts usage events to the environment-selected Tray API at `private/v1/helix/analytics`, using the saved Tray session token.
- The analytics payload includes `projectName`; the `helix init` command accepts a project name or directory argument and derives the event’s project name from it.
- The changelog discloses analytics for `init`, `login`, `dev`, and `deploy`, but says command arguments are not included.
Evidence against
- Analytics is sent to Tray’s own API and only when a saved login token is available.
- The changelog says analytics excludes source code, file paths, and credentials.
- The package recognizes `DO_NOT_TRACK=1` or `true` to suppress analytics.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @trayai/helix-cli@0.65.0
matchedIdentity = npm:QHRyYXlhaS9oZWxpeC1jbGk:0.65.0
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg162${u}
L163: `:typeof f=="string"?`Deploy failed [${f}]: ${u}`:`Deploy failed: ${u}`),await d("failure",m instanceof Error&&m.name?m.name:"Error"),process.exit(1)}})}import{existsSync as wc}fro...
L164: `):r.write(`[warn] Not a valid UUID after ${Dt} attempts \u2014 skipping. Edit helix.config.ts manually.
High
157Open this link to create ${t}:`),console.log(e.url),console.error(`
L158: Press enter once you've finished in the browser.`)}function Ms(e){return Vr({message:"Finished in the browser?",default:!0})}async function Hs(e){return $s({message:"Alias for this...
L159: \u2713 Workspace "${he.name}" created`);try{await D(l,he.id,{configFile:a})}catch(On){throw Ye(he,On)}console.log(` \u21B3 workspaceId ${he.id} written to ${po(a)??"helix.config.t...
...
L162: ${u}
L163: `:typeof f=="string"?`Deploy failed [${f}]: ${u}`:`Deploy failed: ${u}`),await d("failure",m instanceof Error&&m.name?m.name:"Error"),process.exit(1)}})}import{existsSync as wc}fro...
L164: `):r.write(`[warn] Not a valid UUID after ${Dt} attempts \u2014 skipping. Edit helix.config.ts manually.
Findings
1 Critical5 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @trayai/helix-cli@0.112.0.
See all versions of @trayai/helix-cli for other recorded verdicts.
- Review the evidence and your use of @trayai/helix-cli@0.112.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.