dojofoo@0.3.0
Installable coding dojos that turn your AI agent into a sensei.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package sends default-on runtime telemetry about course activity and, for GitHub installs, repository details to its own service. The payload examined does not show credential theft or local-path collection, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A CLI course action queues an event; the CLI flushes queued events after the command.
Impact
The package service receives course usage and repository metadata without an explicit telemetry prompt; the observed payload does not contain credentials or local paths.
Mechanism
The package POSTs an event with a workspace instance ID, course ID, action, timestamp, optional kata, and for GitHub installs the repository and integrity to dojofoo.vercel.app.
AI rationale
The package sends default-on runtime telemetry about course activity and, for GitHub installs, repository details to its own service. The payload examined does not show credential theft or local-path collection, so this warrants a warning rather than a block.
Evidence
dist/index.js.dojo/registration-outbox.json.dojo/instance.json
Network endpoints1
dojofoo.vercel.app
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime event reporting is enabled by default; DO_NOT_TRACK or DOJO_TELEMETRY_DISABLED set to 1 or true disables it, and the default API host is dojofoo.vercel.app.
- Reports contain course ID, event, time, optional kata, and for GitHub installs the repository and integrity; the CLI posts them with a workspace instance ID to /api/v1/events.
- Course events are queued during CLI course actions and flushed after the command completes.
Evidence against
- The observed report fields do not include credentials or local file paths.
- The events are associated with course actions, and the package provides environment-variable opt-outs.
- The Vercel authentication code uses Vercel OAuth endpoints as part of its sign-in and token refresh flow.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
Source & flagged code
24 flaggeddist/chunk-6UVY7KRU.jsView file
6793import { promisify } from "node:util";
L6794: import { execFile as execFileCallback, execFileSync as execFileSyncOriginal } from "node:child_process";
L6795: import { fileURLToPath } from "node:url";
High
Child Process
Package source references child process execution.
dist/chunk-6UVY7KRU.jsView on unpkg · L6793dist/ui/server/_ssr/dist-i0cAx3Zn.mjsView file
313];
L314: parsed.command = process.env.comspec || "cmd.exe";
L315: parsed.options.windowsVerbatimArguments = true;
High
Shell
Package source references shell execution.
dist/ui/server/_ssr/dist-i0cAx3Zn.mjsView on unpkg · L313dist/ui/server/_ssr/router-C4LvVjbW.mjsView file
Findings
3 Critical14 High9 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationnode_modules/@dojofoo/agent/dist/eve/dist/src/internal/model-auth/vercel.js
CriticalRemote Asset Decode Executenode_modules/@dojofoo/authoring/dist/prepared/kyoshi/server/node_modules/libfx/durable/vercel.mjs
CriticalTrojan Source Unicodedist/ui/public/assets/browser-D_SwuIgc.js
HighChild Processdist/chunk-6UVY7KRU.js
HighShelldist/ui/server/_ssr/dist-i0cAx3Zn.mjs
HighEvaldist/ui/server/_ssr/router-C4LvVjbW.mjs
HighSame File Env Network Executiondist/ui/server/_ssr/router-C4LvVjbW.mjs
HighHost Fingerprint Exfiltrationnode_modules/@dojofoo/authoring/dist/prepared/kyoshi/server/node_modules/libfx/durable/vercel.mjs
HighCommand Output Exfiltrationnode_modules/@dojofoo/authoring/dist/prepared/kyoshi/server/node_modules/just-bash/dist/bundle/chunks/js-exec-NDLXDUBN.js
Affected versions and remediation
This report applies to dojofoo@0.3.0.
See all versions of dojofoo for other recorded verdicts.
- Review the evidence and your use of dojofoo@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.