keyhand@0.1.0-pre.4
Keyhand CLI: identities, secrets and login checks for browser agents.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe login trace is transmitted automatically as part of a user-started login, and the packaged README does not clearly disclose that telemetry. The behavior is limited to the package’s own API and login purpose, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user starts a login through the SDK or CLI test command.
Impact
Keyhand receives login activity metadata without a clear telemetry disclosure in the packaged README; session state is also transmitted as part of the product’s login and session reuse behavior.
Mechanism
The SDK builds a trace containing login host and normalized path information, then includes it in the lease release request. Successful runs may also send browser session state.
AI rationale
The login trace is transmitted automatically as part of a user-started login, and the packaged README does not clearly disclose that telemetry. The behavior is limited to the package’s own API and login purpose, so this warrants a warning rather than a block.
Evidence
dist/keyhand-CHqQyyQf.mjsdist/src-DniIPvR8.mjsdist/index.mjs
Network endpoints2
keyhand-api.kumarbharath63.workers.devUser-configured KEYHAND_API_URL
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The SDK records login structure in a trace that its source labels telemetry.
- The trace can include the identity host and normalized page path; form structure is fingerprinted.
- At the end of a login run, the release body includes the trace and may include browser session state, then posts to the API.
- The CLI defaults to the Keyhand API host, with a user-configurable override.
- The package has no install lifecycle scripts; its declared scripts are build and typecheck.
Evidence against
- The README describes the package as managing browser-agent identities and secrets and running login checks.
- Trace transmission occurs as part of a login run initiated by the user, rather than on installation or import.
- The CLI reads the Keyhand API key through its sign-in flow, and the API URL can be configured.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
5 flaggeddist/keyhand-CHqQyyQf.mjsView file
6import { hostname } from "node:os";
L7: import { createHash, createPrivateKey, createPublicKey } from "node:crypto";
L8: //#region ../sdk/src/fill.ts
...
L420: const spkiOf = (pkcs8) => createPublicKey(createPrivateKey({
L421: key: Buffer.from(pkcs8, "base64url"),
L422: format: "der",
...
L544: const seed = async (a) => {
L545: for (const p of passkeys) await a.s.send("WebAuthn.addCredential", {
L546: authenticatorId: a.id,
...
L659: try {
L660: res = await fetch(new URL(path, baseUrl), {
L661: method,
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/keyhand-CHqQyyQf.mjsView on unpkg · L6216patternName = generic_password
severity = medium
line = 216
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/keyhand-CHqQyyQf.mjsView on unpkg · L216716/** Collects one login's structure for the `release` body (docs/telemetry.md §2). Telemetry never fails a run. */
var TraceRecorder = class {
#steps = [];
#start = null;
/** Notes where the login began. A page off the identity's ho
Findings
1 High7 Medium4 Low
HighSandbox Evasion Gated Capabilitydist/keyhand-CHqQyyQf.mjs
MediumSecret Patterndist/keyhand-CHqQyyQf.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/index.mjs
MediumAi Review Evidencedist/keyhand-CHqQyyQf.mjs
MediumAi Review Evidencedist/keyhand-CHqQyyQf.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to keyhand@0.1.0-pre.4.
See all versions of keyhand for other recorded verdicts.
- Review the evidence and your use of keyhand@0.1.0-pre.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.