create-devvit@0.15.1
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s CLI sends runtime telemetry to the Devvit service by default, including the raw command line before parsing it. Because command arguments can contain identifying or sensitive details and telemetry is not opt-in, this is suspicious rather than malicious.
Static reason
No blocking static signals were detected.
Trigger
Running the create-devvit CLI entry point.
Impact
Command arguments may contain identifying or sensitive details and are transmitted without an explicit opt-in.
Mechanism
The init command sends a “ran” event before parsing arguments; its event fields include the raw command line. Metrics are enabled by default, with an environment-variable and opt-out-file disable path.
AI rationale
The package’s CLI sends runtime telemetry to the Devvit service by default, including the raw command line before parsing it. Because command arguments can contain identifying or sensitive details and telemetry is not opt-in, this is suspicious rather than malicious.
Evidence
dist/index.js.lpm-dependency-evidence-ece412cb-66f9-4c4e-984d-d79e025f929c/0/npm-linux/dist/commands/init.js.lpm-dependency-evidence-ece412cb-66f9-4c4e-984d-d79e025f929c/0/npm-linux/dist/util/metrics.js.lpm-dependency-evidence-ece412cb-66f9-4c4e-984d-d79e025f929c/0/npm-linux/dist/util/clientGenerators.js
Network endpoints1
developers.reddit.com/api/events
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes dist/index.js as its main entry and CLI bin.
- Running the entry point calls the Devvit CLI init command, which sends a “ran” event before parsing command arguments.
- The event includes the raw CLI command line from process.argv.
- Metrics are enabled by default unless disabled through DEVVIT_DISABLE_METRICS or an opt-out file.
- The event client sends to the Devvit portal events API.
Evidence against
- The telemetry is sent to the package’s own Devvit service and can be disabled.
- The package has no preinstall, install, or postinstall hook; its prepublishOnly script is not normally run during registry installation.
Behavioral surface
Source & flagged code
7 flaggedpackage.jsonView file
10"exports": {
".": "./dist/index.js",
"./package.json": "./package.json",
"./*": "./dist/*"
},
"main": "./dist/index.js",
"bin": "./dist/index.js",
"files": [
"dist/**"
],
"scripts": {
"build": "ts
Medium
Ai Review Evidence
The package exposes dist/index.js as its main entry and CLI bin.
package.jsonView on unpkg · L10dist/index.jsView file
1#!/usr/bin/env -S node --no-warnings=ExperimentalWarning
import CreateApp from '@devvit/cli/commands/init.js';
try {
await CreateApp.run();
process.exit(0);
}
catch (err) {
Medium
Ai Review Evidence
Running the entry point calls the Devvit CLI init command, which sends a “ran” event before parsing command arguments.
dist/index.jsView on unpkg · L1.lpm-dependency-evidence-ece412cb-66f9-4c4e-984d-d79e025f929c/0/npm-linux/dist/commands/init.jsView file
Findings
7 Medium2 Low
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/index.js
MediumAi Review Evidence.lpm-dependency-evidence-ece412cb-66f9-4c4e-984d-d79e025f929c/0/npm-linux/dist/commands/init.js
MediumAi Review Evidence.lpm-dependency-evidence-ece412cb-66f9-4c4e-984d-d79e025f929c/0/npm-linux/dist/commands/init.js
MediumAi Review Evidence.lpm-dependency-evidence-ece412cb-66f9-4c4e-984d-d79e025f929c/0/npm-linux/dist/util/metrics.js
MediumAi Review Evidence.lpm-dependency-evidence-ece412cb-66f9-4c4e-984d-d79e025f929c/0/npm-linux/dist/util/clientGenerators.js
MediumAi Review Evidence.lpm-dependency-evidence-ece412cb-66f9-4c4e-984d-d79e025f929c/0/npm-linux/dist/util/config.js
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to create-devvit@0.15.1.
See all versions of create-devvit for other recorded verdicts.
- Review the evidence and your use of create-devvit@0.15.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.