@vox-ai/cli-darwin-x64@0.1.0-beta.45
Prebuilt darwin-x64 binary for the vox.ai CLI
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe README discloses that official builds send signed-in account details, including email and name, to PostHog and provide no telemetry opt-out. Under the review rules, telemetry carrying identifying details is suspicious even when disclosed.
Static reason
No blocking static signals were detected.
Trigger
CLI usage in official builds, with signed-in account metadata.
Impact
Usage and identifying account details are disclosed to an analytics service without a way to disable collection in official builds.
Mechanism
The README says usage and account metadata are sent to PostHog; signed-in events include email, name, local profile, install ID, last login time, and organization metadata. Official builds have no telemetry opt-out.
AI rationale
The README discloses that official builds send signed-in account details, including email and name, to PostHog and provide no telemetry opt-out. Under the review rules, telemetry carrying identifying details is suspicious even when disclosed.
Evidence
README.md
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The README says official builds always send CLI usage and signed-in account metadata to PostHog, including the user's email, name, local profile, install ID, and organization metadata.
- The README says official builds have no telemetry opt-out.
- The manifest exposes bin/vox as the package command and lists no lifecycle scripts.
Evidence against
- The package describes a vox.ai CLI, and its telemetry is disclosed in the README.
- The README says telemetry excludes prompts, paths, argument values, file contents, tokens, secrets, message content, customer data, hostnames, and free-text errors.
- The package ships a platform-specific native executable; the available embedded-source analysis is limited and does not establish the full telemetry implementation.
Behavioral surface
Source & flagged code
4 flaggedbin/voxView file
•path = bin/vox
kind = native_binary
sizeBytes = 126535600
magicHex = [redacted]
Medium
README.mdView file
119Official builds always send CLI usage and signed-in account metadata. Signed-in events identify the vox user and update the PostHog Person profile with the user's email, name, local profile, install ID, last login time, and current/default organization metadata. Usage properties include the command, exit status, CLI ve
Medium
Ai Review Evidence
The README says official builds always send CLI usage and signed-in account metadata to PostHog, including the user's email, name, local profile, install ID, and organization metadata.
README.mdView on unpkg · L119121The CLI does not send prompts, paths, argument values, file contents, tokens, secrets, message content, customer data, hostnames, or free-text errors. Official builds do not provide a telemetry opt-out.
Development
Findings
4 Medium
MediumShips Native Binarybin/vox
MediumAi Review EvidenceREADME.md
MediumAi Review EvidenceREADME.md
MediumSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @vox-ai/cli-darwin-x64@0.1.0-beta.45.
See all versions of @vox-ai/cli-darwin-x64 for other recorded verdicts.
- Review the evidence and your use of @vox-ai/cli-darwin-x64@0.1.0-beta.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.