@xship/cli@0.0.147
Configure Claude Code, Codex, Grok Build and other coding tools for Xship AI with one command
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe source shows default-on runtime telemetry that is not disclosed in the README, with some event details capable of carrying local executable paths. The telemetry has an opt-out and goes to the configured service, so this supports a warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Runs during ordinary CLI command use unless telemetry is disabled.
Impact
The service may receive information about commands used and local executable locations without clear telemetry disclosure.
Mechanism
Collects command events and sends them with an install ID and machine/runtime details to the configured service endpoint; some event details contain local binary paths.
AI rationale
The source shows default-on runtime telemetry that is not disclosed in the README, with some event details capable of carrying local executable paths. The telemetry has an opt-out and goes to the configured service, so this supports a warning rather than a malicious verdict.
Evidence
dist/lib/telemetry.jsdist/lib/command.jsdist/lib/tools/codex.js
Network endpoints1
Configured base URL: POST /api/platform/vibecode/telemetry
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime telemetry is enabled by default; it can be disabled with the TELEMETRY environment variable.
- Ordinary CLI invocations record command events and selected arguments.
- Telemetry sends event batches to /api/platform/vibecode/telemetry on the configured base URL.
- The telemetry payload includes an install ID, CLI version, brand, OS, OS release, architecture, and Node version.
- Some telemetry details include local executable paths when Codex catalog binaries are rejected.
Evidence against
- Telemetry has an opt-out, and error text is passed through home-path and secret masking.
- The telemetry request uses the configured service base URL; the source does not show credentials being sent to an unrelated collector.
- The detailed doctor report is uploaded only through the explicit report option.
Behavioral surface
ChildProcessEnvironmentVarsNetworkShell
HighEntropyStringsMinified
Source & flagged code
7 flaggeddist/lib/tools/desktop-process.jsView file
1import{spawnSync as e}from"child_process";import{logger as t}from"../../utils/logger.js";export const WINDOWS_PACKAGE_FAMILIES=["Claude_pzs8sxrjxfjjc","AnthropicPBC.Claude_fnn82j28...
High
Child Process
Package source references child process execution.
dist/lib/tools/desktop-process.jsView on unpkg · L1dist/lib/tools/tool-installs.jsView file
1import{spawnSync as t}from"child_process";import{existsSync as r,realpathSync as n,statSync as e}from"fs";import{delimiter as o,dirname as s,isAbsolute as i,join as a}from"path";im...
High
1import{spawnSync as t}from"child_process";import{existsSync as r,realpathSync as n,statSync as e}from"fs";import{delimiter as o,dirname as s,isAbsolute as i,join as a}from"path";im...
Findings
1 Critical5 High4 Medium3 Low
CriticalPrevious Version Dangerous Deltadist/lib/tools/claude-desktop-app.js
HighChild Processdist/lib/tools/desktop-process.js
HighShelldist/lib/tools/tool-installs.js
HighSame File Env Network Executiondist/lib/tools/claude-desktop-cli.js
HighTrigger Reachable Persistencedist/lib/env-cleanup.js
HighRuntime Package Installdist/lib/tools/tool-installs.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/persistent-env.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @xship/cli@0.0.147.
See all versions of @xship/cli for other recorded verdicts.
- Review the evidence and your use of @xship/cli@0.0.147 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.