registry / blokctl / 1.2.0

blokctl@1.2.0

cli for blok

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Default-enabled PostHog telemetry exports full command option objects, including supplied authentication tokens and API keys. The CLI writes a local analytics identifier under ~/.blok.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Run blokctl login --token or an AI generation command with --api-key.

Impact

Credential exfiltration to a third-party telemetry endpoint.

Mechanism

Default telemetry captures unredacted command arguments to PostHog.

Attack narrative

The shared command wrapper forwards command options to PostHog. Login options can contain a Bloks token, and AI-generation options can contain an OpenAI API key. PostHog telemetry is enabled unless the unrelated NO_NANOCTL_TELEMETRY variable is set, so these secrets are sent to the hard-coded PostHog host whenever those user-invoked commands run.

Rationale

Source establishes a reachable, default-enabled credential-exfiltration path with no redaction. Absence of lifecycle hooks does not mitigate runtime export of authentication secrets.

Evidence

package.jsondist/services/posthog.jsdist/services/commander.jsdist/commands/login/index.jsdist/commands/generate/index.js

Network endpoints1

us.i.posthog.com

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/services/posthog.js sends command args to https://us.i.posthog.com by default.
dist/commands/login/index.js passes the --token option to telemetry.
dist/commands/generate/index.js passes --api-key/OPENAI_API_KEY-derived options to telemetry.
Telemetry opt-out checks unrelated NO_NANOCTL_TELEMETRY variable.

Evidence against

package.json has no install lifecycle hooks.
Exfiltration occurs when the CLI is run, not during npm installation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 127 file(s), 2.05 MB of source, external domains: adoptium.net, api.example.com, api.test, atomic.deskree.com, blok.build, countriesnow.space, dashboard.stripe.com, docs.blok.io, dotnet.microsoft.com, example.com, fb.me, fulfillment.internal, getcomposer.org, github.com, go.dev, hooks.example.com, json-schema.org, maven.apache.org, openrouter.ai, php.net, pro.reactflow.dev, python.org, react.dev, reactflow.dev, registry.npmjs.org, ruby-lang.org, runner-dev.dac-us-east-1.deskree.com, runner.dac-us-east-1.deskree.com, rustup.rs, tanstack.com, us.i.posthog.com, www.w3.org

Source & flagged code

3 flagged

dist/services/posthog.jsView file

Lines 1-29javascript

1import { randomUUID } from "node:crypto";

2import { existsSync, readFileSync, writeFileSync } from "node:fs";

3import os from "node:os";

4import { PostHog } from "posthog-node";

5export class PosthogAnalytics {

6 sessionId;

7 client;

8 distinctId;

9 version;

10 constructor({ version, apiKey = "phc_2xrtQviE7fuks4uth84sqTIq7gOErCX7FOATRjHjzBa", host = "https://us.i.posthog.com", cliConfigPath, }) {

11 this.version = version;

12 if (existsSync(cliConfigPath)) {

13 try {

14 const { distinctId, sessionId } = JSON.parse(readFileSync(cliConfigPath, "utf-8"));

15 this.distinctId = distinctId;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/services/posthog.jsView on unpkg · L9

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/services/posthog.jsView on unpkg · L9

16 this.sessionId = sessionId;

17 }

18 catch (e) {

19 this.sessionId = randomUUID();

20 this.distinctId = this.getDistinctId();

21 }

22 this.writeCliConfig({

23 distinctId: this.distinctId,

24 sessionId: this.sessionId,

25 }, cliConfigPath);

26 }

27 else {

28 this.sessionId = randomUUID();

29 this.distinctId = this.getDistinctId();

dist/commands/create/project.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = blokctl@1.4.1 matchedIdentity = npm:Ymxva2N0bA:1.4.1 similarity = 0.642 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/create/project.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/services/posthog.jsView file

9version; L10: constructor({ version, apiKey = "phc_2xrtQviE7fuks4uth84sqTIq7gOErCX7FOATRjHjzBa", host = "https://us.i.posthog.com", cliConfigPath, }) { L11: this.version = version; ... L13: try { L14: const { distinctId, sessionId } = JSON.parse(readFileSync(cliConfigPath, "utf-8")); L15: this.distinctId = distinctId; ... L57: isTelemetryEnabled() { L58: if (process.env.NO_NANOCTL_TELEMETRY) { L59: return false; ... L63: getDistinctId() { L64: const machineId = os.hostname(); L65: return `blokctl-${machineId}`;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/services/posthog.jsView on unpkg · L9

9Trigger-reachable chain: manifest.main -> dist/index.js -> dist/services/posthog.js L9: version; L10: constructor({ version, apiKey = "phc_2xrtQviE7fuks4uth84sqTIq7gOErCX7FOATRjHjzBa", host = "https://us.i.posthog.com", cliConfigPath, }) { L11: this.version = version; ... L13: try { L14: const { distinctId, sessionId } = JSON.parse(readFileSync(cliConfigPath, "utf-8")); L15: this.distinctId = distinctId; ... L57: isTelemetryEnabled() { L58: if (process.env.NO_NANOCTL_TELEMETRY) { L59: return false; ... L63: getDistinctId() { L64: const machineId = os.hostname(); L65: return `blokctl-${machineId}`;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/services/posthog.jsView on unpkg · L9

Findings

3 Critical5 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/services/posthog.js

CriticalTrigger Reachable Dangerous Capabilitydist/services/posthog.js

CriticalPrevious Version Dangerous Deltadist/commands/create/project.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings