@trayai/helix-cli@0.113.0
Helix CLI — helix init, helix dev, helix auth
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe CLI sends undisclosed runtime analytics to Tray after common commands, and the payload can include a user-supplied project name. The opt-out and first-party destination reduce the risk; I found no evidence for the reported foreign credential redirect or an install-time attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `helix init`, `login`, `dev` or `deploy`; analytics runs after success or failure unless `DO_NOT_TRACK` is set to `1` or `true`.
Impact
Tray receives command outcome and project metadata, including a project name derived from the `helix init` argument. No credential theft or unrelated destination was identified.
Mechanism
The CLI sends a Tray-authenticated POST to `/private/v1/helix/analytics` with event, runtime and locale fields and optional workspace ID, project ID and project name.
AI rationale
The CLI sends undisclosed runtime analytics to Tray after common commands, and the payload can include a user-supplied project name. The opt-out and first-party destination reduce the risk; I found no evidence for the reported foreign credential redirect or an install-time attack.
Evidence
dist/cli.js
Network endpoints1
Tray API host selected by the SDK environment profile; path `/private/v1/helix/analytics`
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- After `init`, `login`, `dev` and `deploy`, the CLI reports success or failure analytics; the payload can include a project name and IDs.
- The analytics payload includes runtime and locale details, project IDs and project name; `DO_NOT_TRACK=1` or `true` disables sending.
- `helix init <project-name>` derives `projectName` from the supplied argument and runs the analytics wrapper.
Evidence against
- The manifest exposes a CLI but declares no install lifecycle hook.
- Analytics uses a Tray API path and a Tray access token; the code does not show sending that token to a foreign host.
- The project archive builder excludes common credential files, environment files and key files.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @trayai/helix-cli@0.65.0
matchedIdentity = npm:QHRyYXlhaS9oZWxpeC1jbGk:0.65.0
similarity = 0.625
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg166${m}
L167: `:typeof g=="string"?`Deploy failed [${g}]: ${m}`:`Deploy failed: ${m}`),await f("failure",u instanceof Error&&u.name?u.name:"Error"),process.exit(1)}})}import{existsSync as Kc}fro...
L168: `):r.write(`[warn] Not a valid UUID after ${Lt} attempts \u2014 skipping. Edit helix.config.ts manually.
High
157Open this link to create ${t}:`),console.log(e.url),console.error(`
L158: Press enter once you've finished in the browser.`)}function Xs(e){return Yr({message:"Finished in the browser?",default:!0})}async function Qs(e){return Ks({message:"Alias for this...
L159: ${t.join(`
...
L161:
L162: Reinstall to pick older versions (delete the lockfile, then install again \u2014 new projects carry an install age limit that avoids this), pin an older version, or redeploy after ...
L163: \u2713 Workspace "${ye.name}" created`);try{await D(a,ye.id,{configFile:p})}catch(zn){throw Ze(ye,zn)}console.log(` \u21B3 workspaceId ${ye.id} written to ${Eo(p)??"helix.config.t...
...
L166: ${m}
L167: `:typeof g=="string"?`Deploy failed [${g}]: ${m}`:`Deploy failed: ${m}`),await f("failure",u instanceof Err
Findings
1 Critical5 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @trayai/helix-cli@0.113.0.
See all versions of @trayai/helix-cli for other recorded verdicts.
- Review the evidence and your use of @trayai/helix-cli@0.113.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.