registry / attribut / 1.0.0

attribut@1.0.0

ATTRIBUT thin allowlist telemetry collector for Claude Code — extracts only safe, signal-bearing fields (never prompt/response/code/diff text) and POSTs them to ingest.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 304 KB of source, external domains: attribut.ai, ingest.attribut.ai, www.apple.com

Source & flagged code

1 flagged

src/timer.cjsView file

Lines 1-35javascript

1'use strict';

3// timer.cjs — the hourly heartbeat OS timer.

4//

5// `attribut connect` installs this once, after the capture hooks are already

6// wired up, so the server can tell "connector went quiet because the agent

7// stopped firing hooks" apart from "connector went quiet because the device

8// is gone" — see heartbeat.cjs for the payload this timer fires.

9//

10// One mechanism per OS, each idempotent (re-running install overwrites the

11// same named unit/task in place, never stacking duplicates):

12// macOS — a launchd user LaunchAgent

13// (~/Library/LaunchAgents/ai.attribut.heartbeat.plist)

14// Linux — a systemd --user service+timer

15// (~/.config/systemd/user/attribut-heartbeat.{service,timer})

16// Windows — a Task Scheduler task via `schtasks /create ... /sc hourly`

17//

18// FAILURE POLICY: best-effort. Unlike registerAgent's hook install (the part

19// of `connect` that must fail loud — it's the actual token pairing), a

20// sandbox/container/WSL box without a working scheduler backend must not fail

21// `attribut connect` outright: the hooks are already live and doing the

22// important work. Timer failures are logged to stderr and swallowed.

23//

24// `ATTRIBUT_SKIP_TIMER_ACTIVATION=1` writes the unit/task file(s) but skips

25// the OS activation call (launchctl/systemctl/schtasks) — used by tests so

26// they never touch the real scheduler on the dev machine or CI runner.

28const fs = require('fs');

29const os = require('os');

30const path = require('path');

31const { execFileSync } = require('child_process');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/timer.cjsView on unpkg · L15

33const installer = require('./install.cjs');

35const LAUNCHD_LABEL = 'ai.attribut.heartbeat';

Source & flagged code

1 flagged · loading source

src/timer.cjsView file

15// (~/.config/systemd/user/attribut-heartbeat.{service,timer}) L16: // Windows — a Task Scheduler task via `schtasks /create ... /sc hourly` L17: // ... L21: // `attribut connect` outright: the hooks are already live and doing the L22: // important work. Timer failures are logged to stderr and swallowed. L23: // ... L30: const path = require('path'); L31: const { execFileSync } = require('child_process'); L32: ... L39: function out(msg) { L40: process.stdout.write(`${msg}\n`); L41: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/timer.cjsView on unpkg · L15

Findings

3 Medium4 Low

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/timer.cjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

src/timer.cjsView file

Lines 1-35javascript

1'use strict';

3// timer.cjs — the hourly heartbeat OS timer.

4//

5// `attribut connect` installs this once, after the capture hooks are already

6// wired up, so the server can tell "connector went quiet because the agent

7// stopped firing hooks" apart from "connector went quiet because the device

8// is gone" — see heartbeat.cjs for the payload this timer fires.

9//

10// One mechanism per OS, each idempotent (re-running install overwrites the

11// same named unit/task in place, never stacking duplicates):

12// macOS — a launchd user LaunchAgent

13// (~/Library/LaunchAgents/ai.attribut.heartbeat.plist)

14// Linux — a systemd --user service+timer

15// (~/.config/systemd/user/attribut-heartbeat.{service,timer})

16// Windows — a Task Scheduler task via `schtasks /create ... /sc hourly`

17//

18// FAILURE POLICY: best-effort. Unlike registerAgent's hook install (the part

19// of `connect` that must fail loud — it's the actual token pairing), a

20// sandbox/container/WSL box without a working scheduler backend must not fail

21// `attribut connect` outright: the hooks are already live and doing the

22// important work. Timer failures are logged to stderr and swallowed.

23//

24// `ATTRIBUT_SKIP_TIMER_ACTIVATION=1` writes the unit/task file(s) but skips

25// the OS activation call (launchctl/systemctl/schtasks) — used by tests so

26// they never touch the real scheduler on the dev machine or CI runner.

28const fs = require('fs');

29const os = require('os');

30const path = require('path');

31const { execFileSync } = require('child_process');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/timer.cjsView on unpkg · L15

33const installer = require('./install.cjs');

35const LAUNCHD_LABEL = 'ai.attribut.heartbeat';