registry / @voyagier/cli / 2.4.0

@voyagier/cli@2.4.0

Voyagier CLI — AI trip planning from your terminal

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 51 file(s), 1.03 MB of source, external domains: github.com, http-intake.logs.datadoghq.com, registry.npmjs.org, travel.voyagier.com

Source & flagged code

2 flagged

dist/telemetry.jsView file

Lines 2-42javascript

2import { hostname } from "os";

3import { readFileSync, writeFileSync, existsSync } from "fs";

4import { join } from "path";

5import { CONFIG_DIR, getUserContext } from "./config.js";

6const TELEMETRY_FILE = join(CONFIG_DIR, "telemetry.json");

7// ── Trace ID (propagated to API for correlation) ──

8let _traceId = null;

9export function getTraceId() {

10 if (!_traceId) {

11 // Generate a 64-bit hex trace ID compatible with Datadog

12 _traceId = randomBytes(8).toString("hex");

13 }

14 return _traceId;

15}

16// ── Opt-in config ──

17function loadTelemetryConfig() {

18 if (!existsSync(TELEMETRY_FILE)) {

19 return { enabled: false, anonymousId: randomUUID() };

20 }

21 try {

22 const raw = readFileSync(TELEMETRY_FILE, "utf-8");

23 return JSON.parse(raw);

24 }

25 catch {

26 return { enabled: false, anonymousId: randomUUID() };

27 }

28}

29function saveTelemetryConfig(config) {

30 writeFileSync(TELEMETRY_FILE, JSON.stringify(config, null, 2), { mode: 0o600 });

31}

32export function isTelemetryEnabled() {

33 // Env override: DD_API_KEY must be set, and telemetry must be opted in

34 if (!process.env.DD_API_KEY)

35 return false;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/telemetry.jsView on unpkg · L22

36 const config = loadTelemetryConfig();

37 return config.enabled;

38}

39export function setTelemetryEnabled(enabled) {

40 const config = loadTelemetryConfig();

41 config.enabled = enabled;

42 if (!config.anonymousId)

dist/commands/doctor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @voyagier/cli@2.2.0 matchedIdentity = npm:QHZveWFnaWVyL2NsaQ:2.2.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/telemetry.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code