balena-cli@25.2.8
The official balena Command Line Interface
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package performs default runtime reporting that associates a cached balena username with command usage and Sentry error reporting. The opt-outs reduce the risk, but the source does not establish clear disclosure, so this is suspicious telemetry rather than malicious exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
Normal CLI startup and command execution, unless disabled with BALENARC_NO_SENTRY or BALENARC_NO_ANALYTICS.
Impact
The vendor and its error-reporting service receive the user’s balena username and command usage during routine CLI use.
Mechanism
The CLI adds the command signature and cached balena username to Sentry’s scope and sends an analytics event containing the username, command signature, package and runtime details to the configured balena analytics endpoint.
AI rationale
The package performs default runtime reporting that associates a cached balena username with command usage and Sentry error reporting. The opt-outs reduce the risk, but the source does not establish clear disclosure, so this is suspicious telemetry rather than malicious exfiltration.
Evidence
build/events.jsbuild/hooks/prerun.jsbuild/app.js
Network endpoints2
data.${balenaUrl}/amplitude/2/httpapiconfig.sentryDsn
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI attaches the command name and cached balena username to Sentry’s reporting scope by default; `BALENARC_NO_SENTRY` disables it.
- The prerun hook calls command tracking for CLI commands, so reporting is triggered during normal command use.
- The analytics event includes the username and command signature, along with package version, platform, architecture, Node version, and the configured balena URL.
Evidence against
- The package’s postinstall hook applies local patches; no patch directories are shipped in the snapshot.
- SSH key upload and deployment behavior are tied to explicit CLI commands and their intended balenaCloud features.
- The compose parser dependency downloads its binary from its own GitHub release path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node patches/apply-patches.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgoclif.manifest.jsonView file
121patternName = generic_password
severity = medium
line = 121
Medium
772patternName = generic_password
severity = medium
line = 772
Medium
Findings
3 High9 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitybuild/utils/sudo.js
HighSemantic Analysis Limitedbuild/commands/deploy/index.js#virtual:string-array:round1
MediumSecret Patternoclif.manifest.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
MediumSecret Patternoclif.manifest.json
MediumSecret Patternoclif.manifest.json
MediumSecret Patternbuild/utils/messages.js
MediumSecret Patternsrc/utils/messages.ts
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to balena-cli@25.2.8.
See all versions of balena-cli for other recorded verdicts.
- Review the evidence and your use of balena-cli@25.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.