agentiqa@1.1.94
AI-powered testing for web and mobile apps
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe install hook is a Node version check, and I found no credential exfiltration or other malicious behavior. Default runtime analytics send CLI usage metadata to the package service; because this telemetry is not disclosed in the package snapshot, classify it as suspicious telemetry.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A normal CLI invocation; the CLI dispatch sends a usage event by default.
Impact
The service receives the command name, package and runtime versions, OS, CI status, and a pseudonymous ID.
Mechanism
The CLI posts event data to `/api/t` on the configured analytics endpoint, defaulting to `https://agentiqa.com/api/t`; telemetry can be opted out through environment variables or config.
AI rationale
The install hook is a Node version check, and I found no credential exfiltration or other malicious behavior. Default runtime analytics send CLI usage metadata to the package service; because this telemetry is not disclosed in the package snapshot, classify it as suspicious telemetry.
Evidence
dist/cli.js~/.agentiqa/analytics.json~/.agentiqa/events-queue.ndjson~/.agentiqa/.installed~/.agentiqa/credentials.json~/.agentiqa/config.json
Network endpoints2
agentiqa.com/api/tAGENTIQA_ANALYTICS_ENDPOINT (configurable)
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Ordinary CLI startup sends a `cli_invoked` event with the command, package version, Node version, OS, and CI status.
- Events are POSTed to an analytics endpoint that defaults to the package service at `https://agentiqa.com/api/t`; an anonymous distinct ID is stored locally.
- Telemetry can be disabled with `DO_NOT_TRACK=1`, `AGENTIQA_TELEMETRY=0`, or a config setting, but the package snapshot does not disclose it.
Evidence against
- The preinstall hook only checks the Node version and exits on versions below 18.
- The inspected event fields are runtime and platform metadata, not credentials, file contents, prompts, or command output.
- The package describes itself as an AI testing CLI, consistent with its CLI startup and telemetry functionality.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
2425L2426: Return a verdict for EVERY item, each with its 0-based "index", a "relation" ("cosmetic" or "critical"), and a one-line "reason".`}function ise(t,e){return t.map(()=>({relation:"cr...
L2427: `}function Rse(t,e,n={}){if(!t||e!=="text")return 0;let r=n.writeStderr??(o=>{process.stderr.write(o)}),s=n.onExit??(o=>{process.once("exit",o)}),i=LKe(t);return r(i),s(()=>r(i)),1...
L2428: `)}function Lt(t,e,n){process.stdout.write(JSON.stringify({ok:!1,schemaVersion:kse,error:{code:t,message:e},...n??{},...Ise()})+`
L2429: `)}import{createServer as VJe}from"node:net";import{createRequire as GJe}from"node:module";import{appendFileSync as HJe}from"node:fs";import{inspect as qJe}from"node:util";import X...
L2430: `).join(""),g,p].join(`
Findings
3 Critical10 High4 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli.js
HighShell
HighEvaldist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
Affected versions and remediation
This report applies to agentiqa@1.1.94.
See all versions of agentiqa for other recorded verdicts.
- Review the evidence and your use of agentiqa@1.1.94 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.