dasyl@2.1.0
Dasyl is a fast, opinionated CLI for creating, configuring, and releasing modern development projects in seconds.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI sends usage telemetry automatically on exit and reports project names after builds, with no visible disclosure or opt-out in the inspected entry point and help. The token is used with the package’s own service, and no unrelated secret collection was found, so this warrants a warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI calls process.exit; the telemetry sender runs detached. Build tracking runs after project generation.
Impact
The Dasyl service receives command and build activity associated with the authenticated account without a documented opt-out.
Mechanism
The sender reads ~/.dasyl/config.json and posts usage fields with the saved Bearer token. Build tracking posts the project name and framework.
AI rationale
The CLI sends usage telemetry automatically on exit and reports project names after builds, with no visible disclosure or opt-out in the inspected entry point and help. The token is used with the package’s own service, and no unrelated secret collection was found, so this warrants a warning rather than a malicious verdict.
Evidence
bin/index.jslib/send-telemetry.jslib/telemetry.jslib/commands/login.js~/.dasyl/config.json
Network endpoints3
dasyl-ten.vercel.app/api/telemetry/logdasyl-ten.vercel.app/api/telemetry/trackprocess.env.DASYL_API_URL (configurable API base URL)
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI replaces process.exit and launches a detached telemetry sender on every exit, including help and error exits.
- When a Dasyl API token is saved, the sender posts the command, duration, status, OS, Node version, and CLI version without an opt-out.
- Build tracking also sends the chosen project name and framework to the Dasyl API using the saved token.
Evidence against
- The token is obtained through the package’s Dasyl login flow and sent to the Dasyl service for authentication and usage tracking.
- The package’s project generation, dependency installation, and optional Git setup fit its stated CLI scaffolding purpose.
- No automatic collection or transmission of unrelated credentials or local files was identified.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/index.jsView file
19import { handleCreate } from '../lib/commands/create.js';
L20: import { spawn } from 'child_process';
L21:
High
6import { checkForUpdates, handleAutoUpdateSetting } from '../lib/update-checker.js';
L7: import shell from 'shelljs';
L8: import boxen from 'boxen';
High
22const globalStartTime = Date.now();
const originalExit = process.exit;
process.exit = (code = 0) => {
const durationMs = Date.now() - globalStartTime;
const status = code === 0 ? 'succes
Medium
Ai Review Evidence
The CLI replaces process.exit and launches a detached telemetry sender on every exit, including help and error exits.
bin/index.jsView on unpkg · L22lib/nest-generator.jsView file
Findings
1 Critical3 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltalib/node-generator.js
HighChild Processbin/index.js
HighShellbin/index.js
HighRuntime Package Installlib/nest-generator.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencebin/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dasyl@2.1.0.
See all versions of dasyl for other recorded verdicts.
- Review the evidence and your use of dasyl@2.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.