@vectoree/cli@0.1.16
Official Vectoree CLI — login, link, database, storage, Model Gateway, and Tool Hub
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package is an otherwise conventional Vectoree CLI, and the flagged execution and network behavior serves its documented commands. However, linking silently reads a persistent OS machine identifier and sends it to the vendor, so this merits a warning for undisclosed device identification.
Decision evidence
public snapshot- The link flow can collect OS machine identifiers, including the macOS platform UUID and Windows MachineGuid.
- When creating a project API key, the link flow sends a deviceId and a hostname-derived key name to the API.
- The machine identifier is collected in the user-invoked link command, which creates a CLI API key.
- The identifier is sent to the package’s own Vectoree API as part of key creation; no unrelated collector or credential theft was identified.
- The manifest exposes the CLI through dist/index.js, and the link action is invoked by the user rather than an install hook or background task.
Source & flagged code
5 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgSource combines command execution, command-output handling, and outbound requests; review data flow before blocking.
Findings
Affected versions and remediation
This report applies to @vectoree/cli@0.1.16.
See all versions of @vectoree/cli for other recorded verdicts.
- Review the evidence and your use of @vectoree/cli@0.1.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.