agentiqa@1.1.98
AI-powered testing for web and mobile apps
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI sends runtime telemetry by default and exposes opt-out controls, but the reviewed source does not disclose the collection to users. The event fields shown are limited to command and runtime metadata, so this is suspicious telemetry rather than data exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
CLI invocation, including its first run, unless telemetry is disabled or the invocation is a live review.
Impact
The vendor can associate basic CLI usage and runtime metadata with a persistent or user-associated identifier.
Mechanism
The CLI sends usage and install events to the configured analytics endpoint, defaulting to the Agentiqa API. Events include command/version, runtime and platform details, CI status, and a distinct ID.
AI rationale
The CLI sends runtime telemetry by default and exposes opt-out controls, but the reviewed source does not disclose the collection to users. The event fields shown are limited to command and runtime metadata, so this is suspicious telemetry rather than data exfiltration.
Evidence
dist/cli.js~/.agentiqa/analytics.json~/.agentiqa/events-queue.ndjson~/.agentiqa/.installed
Network endpoints2
agentiqa.com/api/tAGENTIQA_ANALYTICS_ENDPOINT (user-configured)
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI sends `cli_installed` and `cli_invoked` telemetry by default, including command, version, Node version, OS, and CI status.
- Telemetry is posted to `${jt()}/api/t` by default and can be redirected with `AGENTIQA_ANALYTICS_ENDPOINT`; it can be disabled with `DO_NOT_TRACK=1`, `AGENTIQA_TELEMETRY=0`, or the config setting.
- The preinstall hook only checks the Node version and exits on versions below 18.
- The manifest identifies `dist/cli.js` as the executable entry point.
Evidence against
- The telemetry code shown collects package/runtime fields and a generated or persisted distinct ID, not credentials or command output.
- The preinstall hook performs no network requests or project-data collection.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
2425L2426: Return a verdict for EVERY item, each with its 0-based "index", a "relation" ("cosmetic" or "critical"), and a one-line "reason".`}function yie(t,e){return t.map(()=>({relation:"cr...
L2427: `}function $ie(t,e,n={}){if(!t||e!=="text")return 0;let r=n.writeStderr??(o=>{process.stderr.write(o)}),s=n.onExit??(o=>{process.once("exit",o)}),i=l3e(t);return r(i),s(()=>r(i)),1...
L2428: `)}function Ot(t,e,n){process.stdout.write(JSON.stringify({ok:!1,schemaVersion:jie,error:{code:t,message:e},...n??{},...Vie()})+`
L2429: `)}import{createServer as g7e}from"node:net";import{createRequire as b7e}from"node:module";import{appendFileSync as y7e}from"node:fs";import{inspect as v7e}from"node:util";import V...
L2430: `).join(""),g,h].join(`
Findings
3 Critical7 High6 Medium5 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
Medium
Affected versions and remediation
This report applies to agentiqa@1.1.98.
See all versions of agentiqa for other recorded verdicts.
- Review the evidence and your use of agentiqa@1.1.98 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.