dasyl@2.0.2
Dasyl is a fast, opinionated CLI for creating, configuring, and releasing modern development projects in seconds.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe active telemetry path forwards an existing service token without restricting its destination, warranting a warning under the credential-forwarding policy. The inspected source does not establish malicious intent or an install-time attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The CLI exits while a saved API token exists.
Impact
An unintended endpoint could receive the user's Dasyl credential and command metadata.
Mechanism
A detached sender reads the stored token and includes it in a telemetry POST to DASYL_API_URL or the localhost default, without destination validation.
AI rationale
The active telemetry path forwards an existing service token without restricting its destination, warranting a warning under the credential-forwarding policy. The inspected source does not establish malicious intent or an install-time attack.
Evidence
bin/index.jslib/send-telemetry.jslib/commands/login.js.dasyl/config.json
Network endpoints2
localhost:3000dasyl-ten.vercel.app
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json defines no install lifecycle hooks; the NestJS command performs user-invoked scaffolding.
- bin/index.js launches a detached telemetry sender when the CLI exits.
- The telemetry destination accepts unrestricted DASYL_API_URL values and defaults to http://localhost:3000.
- The sender reads the saved Dasyl API token from the user's configuration and proceeds whenever it exists.
- The telemetry POST includes that token in its Authorization header.
- The login command saves the user-supplied Dasyl token for subsequent use.
Evidence against
- The credentials belong to Dasyl authentication, and the main authentication API defaults to a Dasyl host.
- No hidden package-controlled unrelated recipient or concrete malicious intent was established.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
UrlStrings
Source & flagged code
7 flaggedbin/index.jsView file
19import { handleCreate } from '../lib/commands/create.js';
L20: import { spawn } from 'child_process';
L21:
High
6import { checkForUpdates, handleAutoUpdateSetting } from '../lib/update-checker.js';
L7: import shell from 'shelljs';
L8: import boxen from 'boxen';
High
32const child = spawn(process.execPath, [
telemetryScript,
command,
durationMs.toString(),
status,
code.toString()
], {
detached: true,
stdio: 'ignore'
});
child.unref();
Medium
Ai Review Evidence
bin/index.js launches a detached telemetry sender when the CLI exits.
bin/index.jsView on unpkg · L32lib/nest-generator.jsView file
Findings
3 High6 Medium3 Low
HighChild Processbin/index.js
HighShellbin/index.js
HighRuntime Package Installlib/nest-generator.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencelib/nest-generator.js
MediumAi Review Evidencebin/index.js
MediumAi Review Evidencelib/send-telemetry.js
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to dasyl@2.0.2.
See all versions of dasyl for other recorded verdicts.
- Review the evidence and your use of dasyl@2.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.