aiblueprint-cli@1.4.114
AIBlueprint CLI for setting up AI coding configurations
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has no install-time hook or identified credential theft, but its undisclosed, default error telemetry sends a local path and error context to the vendor. This is a warning-level telemetry concern.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An error in a CLI command, including setup failure.
Impact
The vendor receives an identifying local filesystem path and error context without an explicit opt-in.
Mechanism
The telemetry event includes the error message, stack trace, and system information containing the home directory, then sends a POST request unless disabled by an environment variable.
AI rationale
The package has no install-time hook or identified credential theft, but its undisclosed, default error telemetry sends a local path and error context to the vendor. This is a warning-level telemetry concern.
Evidence
dist/cli.js
Network endpoints1
codelynx.dev/api/cli/events
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On CLI errors, telemetry includes the error message, stack trace, and system information in its event data.
- The system information includes the user's home directory path.
- The CLI posts telemetry by default to its vendor's endpoint; it can be disabled with AIBLUEPRINT_TELEMETRY_DISABLED=1.
Evidence against
- The manifest exposes a CLI and has no install, preinstall, or postinstall hook.
- The statusline sends its Claude credential only to Anthropic's OAuth usage endpoint for usage-limit data.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
11 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = aiblueprint-cli@1.4.96
matchedIdentity = npm:YWlibHVlcHJpbnQtY2xp:1.4.96
similarity = 0.926
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg625var EventEmitter = __require("node:events").EventEmitter;
L626: var childProcess = __require("node:child_process");
L627: var path = __require("node:path");
High
1067}
L1068: const execArgv2 = process2.execArgv ?? [];
L1069: if (execArgv2.includes("-e") || execArgv2.includes("--eval") || execArgv2.includes("-p") || execArgv2.includes("--print")) {
High
Findings
1 Critical7 High6 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighSandbox Evasion Gated Capabilityagents-config/claude-config/scripts/statusline/src/lib/features/limits/index.ts
HighTrigger Reachable Persistencedist/cli.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limitedagents-config/skills/skill-manager/scripts/inspect-description.ts
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
MediumShips Build Helperagents-config/skills/apex/scripts/setup-templates.sh
Affected versions and remediation
This report applies to aiblueprint-cli@1.4.114.
See all versions of aiblueprint-cli for other recorded verdicts.
- Review the evidence and your use of aiblueprint-cli@1.4.114 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.