@xship/cli@0.0.155
Configure Claude Code, Codex, Grok Build and other coding tools for Xship AI with one command
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package sends runtime telemetry by default, and the README does not disclose it, which makes the behavior suspicious. The inspected payload and transport do not establish unrelated credential theft or another blocking attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI commands that record telemetry events; events are batched and sent after tracking.
Impact
The service receives command and operation metadata, optional error text and optional details; this is a privacy risk because the package does not disclose telemetry in its README.
Mechanism
The telemetry module sends event records to a path on the configured service base URL. TELEMETRY=0, false or off disables collection.
AI rationale
The package sends runtime telemetry by default, and the README does not disclose it, which makes the behavior suspicious. The inspected payload and transport do not establish unrelated credential theft or another blocking attack.
Evidence
dist/lib/telemetry.jsdist/lib/command.jsREADME.md
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest defines no lifecycle scripts; its main entry is dist/index.js and its CLI is dist/cli.js.
- Importing dist/index.js re-exports library modules without invoking command execution.
- Runtime telemetry is enabled unless TELEMETRY is set to 0, false or off.
- Telemetry events include command, step, status, duration, errors and optional details, and are sent to /api/platform/vibecode/telemetry using the configured base URL.
- CLI command telemetry filters arguments to flags and excludes flags whose names contain “key”.
- Persistent shell environment writes are implemented as a helper, not an install hook.
Evidence against
- Telemetry uses a configured service base URL and may attach the package service API key; no unrelated collector or credential theft was identified.
- The CLI has an explicit TELEMETRY opt-out.
- The package purpose is configuring coding tools, consistent with its command-driven install and environment setup features.
Behavioral surface
ChildProcessEnvironmentVars
Source & flagged code
7 flaggeddist/lib/tools/chatgpt-desktop.jsView file
1import{spawnSync as t}from"child_process";import{logger as n}from"../../utils/logger.js";import{brand as e}from"../brand.js";import{powerShellEnv as r}from"../powershell-env.js";im...
High
Child Process
Package source references child process execution.
dist/lib/tools/chatgpt-desktop.jsView on unpkg · L1dist/lib/tools/tool-installs.jsView file
1import{spawnSync as t}from"child_process";import{existsSync as n,realpathSync as r,statSync as e}from"fs";import{delimiter as o,dirname as s,isAbsolute as i,join as a}from"path";im...
High
1import{spawnSync as t}from"child_process";import{existsSync as n,realpathSync as r,statSync as e}from"fs";import{delimiter as o,dirname as s,isAbsolute as i,join as a}from"path";im...
Findings
1 Critical5 High4 Medium3 Low
CriticalPrevious Version Dangerous Deltadist/lib/components.js
HighChild Processdist/lib/tools/chatgpt-desktop.js
HighShelldist/lib/tools/tool-installs.js
HighSame File Env Network Executiondist/lib/tools/claude-desktop-cli.js
HighTrigger Reachable Persistencedist/lib/env-cleanup.js
HighRuntime Package Installdist/lib/tools/tool-installs.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/persistent-env.js
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @xship/cli@0.0.155.
See all versions of @xship/cli for other recorded verdicts.
- Review the evidence and your use of @xship/cli@0.0.155 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.