@withone/cli@2.10.0
CLI for managing One
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe CLI discloses runtime usage analytics and offers an opt-out, but its analytics profile can also send account email, name, and organization ID to PostHog without specifically describing those fields. This is a privacy concern warranting a warning, not a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A CLI command invokes the pre-action hook, which records usage and drains the analytics queue unless telemetry is disabled.
Impact
Account-identifying details are shared with an analytics provider without being specifically described in the telemetry notice.
Mechanism
Analytics events are posted to PostHog; authenticated-user profiles can include email, name, and organization ID.
AI rationale
The CLI discloses runtime usage analytics and offers an opt-out, but its analytics profile can also send account email, name, and organization ID to PostHog without specifically describing those fields. This is a privacy concern warranting a warning, not a publish block.
Evidence
dist/chunk-5CPQHXTO.jsdist/index.jsdist/chunk-3HRC3IPE.js.one/.analytics-queue.jsonl.one/.cli-usage-log.jsonl
Network endpoints2
us.i.posthog.comapi.openai.com/v1/embeddings
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The CLI’s pre-action hook records commands and drains the analytics queue by default; users can disable telemetry with ONE_NO_TELEMETRY=1.
- For authenticated users, analytics profile properties include account email, name, and organization ID, and events are sent to PostHog.
- The telemetry notice describes command usage linked to a One account and says arguments, inputs, and secrets are not collected, but does not mention sending email, name, or organization ID.
- OpenAI embeddings use the supplied key with OpenAI’s official embeddings endpoint when the OpenAI provider is enabled.
Evidence against
- The package is a CLI; its bin entry imports the command program and parses user-supplied arguments.
- The telemetry notice discloses usage analytics and provides an opt-out.
- Browser-login install context is presented to the user before the browser opens, and the consent page records it on the key.
- The manifest’s prepare script runs the package build.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
12 flaggeddist/chunk-NOPTG4GC.jsView file
1465import { createRequire } from "module";
L1466: import { spawn, spawnSync } from "child_process";
L1467: var requireFromHere = createRequire(import.meta.url);
High
Child Process
Package source references child process execution.
dist/chunk-NOPTG4GC.jsView on unpkg · L14651773patternName = generic_password
severity = medium
line = 1773
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-NOPTG4GC.jsView on unpkg · L17731310if (this.backend) return this.backend;
L1311: const pg = await import("pg").catch((err) => {
L1312: const msg = err instanceof Error ? err.message : String(err);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-NOPTG4GC.jsView on unpkg · L1310dist/chunk-5CPQHXTO.js
Findings
1 Critical6 High6 Medium9 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/chunk-NOPTG4GC.js
HighShelldist/chunk-5CPQHXTO.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumSecret Patterndist/chunk-NOPTG4GC.js
MediumDynamic Requiredist/chunk-NOPTG4GC.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
Affected versions and remediation
This report applies to @withone/cli@2.10.0.
See all versions of @withone/cli for other recorded verdicts.
- Review the evidence and your use of @withone/cli@2.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.