instabox@0.8.49
A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install-time hook, and the inspected JavaScript sends credentials to the configured Instabox API while limiting disclosed onboarding telemetry to usage and runtime data with an opt-out. Native CLI binaries are only partially resolved by the provided static summaries, but their packaging and invocation match the package’s stated CLI purpose.
Decision evidence
public snapshot- The package has no install, preinstall, or postinstall script; its listed scripts are packaging, testing, and formatting tasks.
- API calls attach credentials as bearer tokens and send requests to the configured Instabox server.
- Telemetry is disclosed, excludes command arguments, and can be disabled with INSTABOX_NO_TELEMETRY or DO_NOT_TRACK.
- Onboarding telemetry is limited to usage outcomes and runtime metadata and is sent only when using the default server.
- The package includes platform-specific native CLI binaries; most provided binary summaries could not statically resolve their behavior.
- The CLI sends runtime telemetry to PostHog by default, though it is disclosed and has opt-out settings.
Source & flagged code
5 flaggedPackage ships native binary artifacts.
cli/instabox-windows-arm64.exeView on unpkgPackage ships non-JavaScript build or shell helper files.
skills/instabox-basic-setup/scripts/install-files.pyView on unpkgFindings
Affected versions and remediation
This report applies to instabox@0.8.49.
See all versions of instabox for other recorded verdicts.
- Review the evidence and your use of instabox@0.8.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.