indiecorns@0.4.3
Indiecorns CLI and agent plugin for account sign-in, onboarding tasks, and local setup checks.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package documents telemetry and provides opt-outs, but its default runtime telemetry sends signed-in users’ email and account identifiers to PostHog. This is identifying telemetry and warrants a warning; the inspected persistence behavior is triggered only by an explicit worker install command.
Static reason
One or more suspicious static signals were detected.
Trigger
Running CLI commands while telemetry is enabled, including the default configuration.
Impact
Indiecorns’ analytics provider receives identifying user details and some command context.
Mechanism
The CLI identifies signed-in users and includes email and account properties in PostHog telemetry; it also sends limited command arguments with basic redaction.
AI rationale
The package documents telemetry and provides opt-outs, but its default runtime telemetry sends signed-in users’ email and account identifiers to PostHog. This is identifying telemetry and warrants a warning; the inspected persistence behavior is triggered only by an explicit worker install command.
Evidence
indiecorns/bin/indiecorns.mjsREADME.mdpackage.jsonindiecorns/lib/service.mjs~/.indiecorns/config.json~/.indiecorns/service-runtime.json~/Library/LaunchAgents/com.indiecorns.worker.plist~/.config/systemd/user/indiecorns-worker.service~/.indiecorns/worker/worker-task.xml~/.indiecorns/worker/worker-launcher.ps1
Network endpoints2
eu.i.posthog.comapp.indiecorns.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI sends disclosed product telemetry to Indiecorns and identifies signed-in users; the code includes user email and account details in telemetry properties.
- Command telemetry includes up to three command arguments, redacting strings that match credential-like terms and email-shaped strings.
- Telemetry is enabled unless disabled by a flag, environment setting, or configuration.
- The manifest exposes a CLI entry point; command tracking runs during CLI startup.
Evidence against
- The package documents its telemetry purpose and provides persistent and per-run opt-outs.
- Telemetry uses PostHog and does not collect the OpenAI key through the telemetry code reviewed.
- Worker service persistence is behind the explicit `worker install` command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetry
Source & flagged code
4 flaggedindiecorns/lib/service.mjsView file
3Trigger-reachable persistence chain: manifest.bin -> indiecorns/bin/indiecorns.mjs -> indiecorns/lib/service.mjs
L3: import { homedir, platform } from 'node:os'
L4: import { spawnSync } from 'node:child_process'
L5: const label = 'com.indiecorns.worker'
...
L9: const unitQuote = value => '"' + String(value).replace(/%/g, '%%').replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, () => '$$') + '"'
L10: export function serviceDefinition({ system = platform(), home = homedir(), node = process.execPath, cli, interval = 300, userId, windowsRoot = process.env.SystemRoot ?? 'C:\\Window...
L11: if (!cli || !Number.isInteger(interval) || interval < 1) throw new Error('Invalid service configuration')
...
L45: content: `<?xml version="1.0" encoding="UTF-16"?>
L46: <Task version="1.4" xmlns="htt
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
indiecorns/lib/service.mjsView on unpkg · L33import { homedir, platform } from 'node:os'
L4: import { spawnSync } from 'node:child_process'
L5: const label = 'com.indiecorns.worker'
...
L9: const unitQuote = value => '"' + String(value).replace(/%/g, '%%').replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, () => '$$') + '"'
L10: export function serviceDefinition({ system = platform(), home = homedir(), node = process.execPath, cli, interval = 300, userId, windowsRoot = process.env.SystemRoot ?? 'C:\\Window...
L11: if (!cli || !Number.isInteger(interval) || interval < 1) throw new Error('Invalid service configuration')
...
L45: content: `<?xml version="1.0" encoding="UTF-16"?>
L46: <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
L47: <RegistrationInfo><Description>Indiecorns community wor
Findings
2 High5 Medium5 Low
HighCopied Package Dependency Bridgeindiecorns/bin/indiecorns.mjs
HighTrigger Reachable Persistenceindiecorns/lib/service.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistenceindiecorns/lib/service.mjs
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceindiecorns/bin/indiecorns.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to indiecorns@0.4.3.
See all versions of indiecorns for other recorded verdicts.
- Review the evidence and your use of indiecorns@0.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.