indiecorns@0.4.13
Indiecorns CLI and agent plugin for account sign-in, onboarding tasks, and local setup checks.
AI Security Review
scanned 17h ago · by lpm-firewall-aiThe CLI sends authenticated user IDs and email addresses to PostHog as runtime telemetry, which is an identifying detail sent to an analytics service. No install-time attack was identified; the persistent worker is installed through an explicit command.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running CLI commands that emit telemetry while signed in; telemetry is enabled unless disabled by a flag, environment variable, or config setting.
Impact
A third-party analytics service receives the user's email and account identifier along with CLI telemetry.
Mechanism
The CLI identifies events with the authenticated Indiecorns user ID and includes the user's email in PostHog properties.
AI rationale
The CLI sends authenticated user IDs and email addresses to PostHog as runtime telemetry, which is an identifying detail sent to an analytics service. No install-time attack was identified; the persistent worker is installed through an explicit command.
Evidence
indiecorns/bin/indiecorns.mjs
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI sends authenticated Indiecorns user IDs and email addresses as PostHog identity and event properties.
- Telemetry is sent through the PostHog client to the configured host, which defaults to eu.i.posthog.com.
- The manifest declares no install, preinstall, or postinstall lifecycle hook.
Evidence against
- Telemetry can be disabled with a CLI flag, environment setting, or configuration setting.
- Worker service persistence is reached through an explicit worker install command.
- GitHub credentials are sent only to api.github.com, with the request origin checked.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggedindiecorns/lib/service.mjsView file
3Trigger-reachable persistence chain: manifest.bin -> indiecorns/bin/indiecorns.mjs -> indiecorns/lib/service.mjs
L3: import { homedir, platform } from 'node:os'
L4: import { spawnSync } from 'node:child_process'
L5: const label = 'com.indiecorns.worker'
...
L9: const unitQuote = value => '"' + String(value).replace(/%/g, '%%').replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, () => '$$') + '"'
L10: export function serviceDefinition({ system = platform(), home = homedir(), node = process.execPath, cli, interval = 300, appUrl, previousVersion, userId, windowsRoot = process.env....
L11: if (!cli || !Number.isInteger(interval) || interval < 1) throw new Error('Invalid service configuration')
...
L54: content: `<?xml version="1.0" encoding="UTF-16"?>
L55: <Task version="1.4" xmlns="htt
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
indiecorns/lib/service.mjsView on unpkg · L33import { homedir, platform } from 'node:os'
L4: import { spawnSync } from 'node:child_process'
L5: const label = 'com.indiecorns.worker'
...
L9: const unitQuote = value => '"' + String(value).replace(/%/g, '%%').replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, () => '$$') + '"'
L10: export function serviceDefinition({ system = platform(), home = homedir(), node = process.execPath, cli, interval = 300, appUrl, previousVersion, userId, windowsRoot = process.env....
L11: if (!cli || !Number.isInteger(interval) || interval < 1) throw new Error('Invalid service configuration')
...
L54: content: `<?xml version="1.0" encoding="UTF-16"?>
L55: <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
L56: <RegistrationInfo><Description>Indiecorns community wor
Findings
3 High4 Medium5 Low
HighCopied Package Dependency Bridgeindiecorns/bin/indiecorns.mjs
HighTrigger Reachable Persistenceindiecorns/lib/service.mjs
HighPrevious Version Dangerous Deltaindiecorns/bin/indiecorns.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistenceindiecorns/lib/service.mjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to indiecorns@0.4.13.
See all versions of indiecorns for other recorded verdicts.
- Review the evidence and your use of indiecorns@0.4.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.