arcroom@0.1.0
AI Security Review
scanned 6d ago · by lpm-firewall-aiRuntime hooks send the machine hostname to ArcRoom's API, but the README's detailed upload disclosure does not mention it. The service destination and team-tracking purpose are consistent with the package, so this is an undisclosed telemetry concern rather than clear malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
After `arcroom init` configures agent hooks, an agent session invokes a hook that records events.
Impact
The service receives a device identifier alongside disclosed activity metadata; this may be intended for team attribution, but the hostname is not disclosed.
Mechanism
Events include the hostname and working directory, are queued locally, and are uploaded by the background daemon to ArcRoom's API.
AI rationale
Runtime hooks send the machine hostname to ArcRoom's API, but the README's detailed upload disclosure does not mention it. The service destination and team-tracking purpose are consistent with the package, so this is an undisclosed telemetry concern rather than clear malicious behavior.
Evidence
dist/events.jsdist/hook.jsdist/daemon.jsdist/home.jsdist/init.jsREADME.md~/.arcroom/spool.jsonl~/.arcroom/config.json.claude/settings.local.json
Network endpoints1
api.arcroomai.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Each runtime event includes the machine hostname and working directory.
- The hook queues events containing those fields, and the daemon uploads event batches.
- The default upload endpoint is api.arcroomai.com.
- The README discloses several categories of uploaded activity data but does not mention the machine hostname.
- The runtime collection is activated by the agent hooks configured by `arcroom init`.
Evidence against
- The hostname is sent to ArcRoom's own API, and identifying machines may support the package's shared team run tracking.
- The README describes uploads of prompts, paths, commands, and other activity data, and provides an `arcroom off` command.
- The only lifecycle script is `prepublishOnly`, which runs the build and tests.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/fresh.jsView file
53const r = git(['ls-files', '--cached', '--others', '--exclude-standard'], { cwd, timeout: 1500 });
L54: files = r.status === 0 ? (r.stdout ?? '').split('\n').filter(Boolean).slice(0, MAX_SCAN) : [];
L55: return files;
Low
dist/home.jsView file
11const rel = custom && isAbsolute(custom) ? relative(cwd, custom) : '';
L12: return custom && isAbsolute(custom) && (rel.startsWith('..') || isAbsolute(rel)) ? custom : join(homedir(), '.arcroom');
L13: }
L14: export const ARCROOM_HOME = homeFrom(process.env.ARCROOM_HOME, process.cwd());
L15: // Repos where this person switched ArcRoom off (arcroom off): no tracing, no lookups, nothing leaves the laptop (I6).
...
L19: try {
L20: return JSON.parse(readFileSync(file, 'utf8'));
L21: }
...
L35: }
L36: // ArcRoom API (the Oracle server behind Caddy). A local API: arcroom init --url http://localhost:8787
L37: export const DEFAULT_URL = 'https://api.arcroomai.com';
...
L59: headers: { Authorization: `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' },
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/home.jsView on unpkg · L11Findings
2 High4 Medium6 Low
HighHost Fingerprint Exfiltrationdist/home.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/init.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/events.js
MediumAi Review Evidencedist/hook.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/fresh.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to arcroom@0.1.0.
See all versions of arcroom for other recorded verdicts.
- Review the evidence and your use of arcroom@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.