devvit@0.15.1
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe CLI’s default runtime telemetry includes raw command arguments, which can contain identifying details, and is sent to the Devvit portal. This is a warning-level telemetry concern; the package wrapper itself has no suspicious install hook.
Static reason
No blocking static signals were detected.
Trigger
By default, when a CLI command runs and its init hook fires.
Impact
Command arguments can contain identifying or sensitive details, which may be transmitted to the package’s service.
Mechanism
The hook places the raw command line in an event; metrics send it to the events API unless disabled or opted out. Only selected arguments are redacted.
AI rationale
The CLI’s default runtime telemetry includes raw command arguments, which can contain identifying details, and is sent to the Devvit portal. This is a warning-level telemetry concern; the package wrapper itself has no suspicious install hook.
Evidence
.lpm-dependency-evidence-d0ab8af2-b772-48a6-be88-294817dce50b/0/npm-linux/dist/lib/hooks/init/fire-event.js.lpm-dependency-evidence-d0ab8af2-b772-48a6-be88-294817dce50b/0/npm-linux/dist/util/metrics.js.lpm-dependency-evidence-d0ab8af2-b772-48a6-be88-294817dce50b/0/npm-linux/dist/util/clientGenerators.js
Network endpoints1
developers.reddit.com/api/events
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI init hook records the command line and includes it in a `devplatform_cli` event; it redacts `settings set` arguments but leaves other command arguments intact.
- Metrics are enabled by default unless disabled with `DEVVIT_DISABLE_METRICS` or an opt-out file, and events are sent to the Devvit portal events endpoint.
- The package is a thin wrapper that re-exports `@devvit/cli`; its only lifecycle script is `prepublishOnly`.
Evidence against
- The telemetry uses a generated session ID rather than a discovered credential.
- The CLI’s init hook explicitly avoids capturing `init` arguments and redacts `settings set` arguments.
- The wrapper’s `prepublishOnly` script is not a registry-install lifecycle hook.
Behavioral surface
Trivial
Source & flagged code
4 flagged.lpm-dependency-evidence-d0ab8af2-b772-48a6-be88-294817dce50b/0/npm-linux/dist/lib/hooks/init/fire-event.jsView file
14const argv = process.argv.slice(2);
const shouldRedactRawCommandLine = shouldRedact(argv);
const cliRawCommandLine = shouldRedactRawCommandLine ? '<redacted>' : `devvit ${argv.join(' ')}`;
CURRENT_COMMAND_EVENT_DATA = {
cli_raw_command_line: cliRawCommandLine,
cli_is_valid_command: Boolean(isValidCommand),
cli_command: isValidCommand ? options.id : undefined,
};
const event = {
source: 'devplatf
Medium
Ai Review Evidence
The CLI init hook records the command line and includes it in a `devplatform_cli` event; it redacts `settings set` arguments but leaves other command arguments intact.
.lpm-dependency-evidence-d0ab8af2-b772-48a6-be88-294817dce50b/0/npm-linux/dist/lib/hooks/init/fire-event.jsView on unpkg · L14.lpm-dependency-evidence-d0ab8af2-b772-48a6-be88-294817dce50b/0/npm-linux/dist/util/metrics.jsView file
Findings
4 Medium2 Low
MediumAi Review Evidence.lpm-dependency-evidence-d0ab8af2-b772-48a6-be88-294817dce50b/0/npm-linux/dist/lib/hooks/init/fire-event.js
MediumAi Review Evidence.lpm-dependency-evidence-d0ab8af2-b772-48a6-be88-294817dce50b/0/npm-linux/dist/util/metrics.js
MediumAi Review Evidence.lpm-dependency-evidence-d0ab8af2-b772-48a6-be88-294817dce50b/0/npm-linux/dist/util/clientGenerators.js
MediumSuspicious Lifecycle Evidencepackage.json
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to devvit@0.15.1.
See all versions of devvit for other recorded verdicts.
- Review the evidence and your use of devvit@0.15.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.