dasyl@1.11.1
Dasyl is a fast, opinionated CLI for creating, configuring, and releasing modern development projects in seconds.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiDirect source inspection shows a user-invoked project generator with explicit telemetry and update functionality, not a covert payload. Network and process-spawn primitives are confined to documented scaffolding, npm registry checks, and selected update/project actions.
Static reason
No blocking static signals were detected.
Trigger
User runs the dasyl CLI or selects a generator/update option.
Impact
Creates requested project files and may persist dasyl preferences in the user's home directory; no unconsented install-time execution found.
Mechanism
Interactive scaffolding, telemetry registration, and optional self-update.
AI rationale
Direct source inspection shows a user-invoked project generator with explicit telemetry and update functionality, not a covert payload. Network and process-spawn primitives are confined to documented scaffolding, npm registry checks, and selected update/project actions.
Evidence
package.jsonbin/index.jslib/telemetry.jslib/update-checker.jslib/node-generator.jslib/frontend-generator.jslib/mobile-generator.jslib/laravel-generator.jsserver/index.jstmp-test/convert.pytmp-test/convert2.py
Network endpoints2
dasyl-ten.vercel.app/apiregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall/prepare hook.
- bin/index.js runs only when the dasyl CLI is invoked.
- lib/telemetry.js sends only chosen username or stored userId to dasyl-ten.vercel.app.
- lib/update-checker.js queries registry.npmjs.org and updates only after opt-in or an interactive choice.
- Generator shell commands scaffold requested projects and install named development dependencies.
- No credential harvesting, remote code loading, eval/vm use, AI-agent config writes, or destructive actions found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
1 flaggedtmp-test/convert.pyView file
•path = tmp-test/convert.py
kind = build_helper
sizeBytes = 1671
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
tmp-test/convert.pyView on unpkgFindings
4 Medium4 Low
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertmp-test/convert.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dasyl@1.11.1.
See all versions of dasyl for other recorded verdicts.
- Review the evidence and your use of dasyl@1.11.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.