kubb@5.15.0
Turn your API spec into type-safe code. Generate TypeScript types, API clients, hooks, validators and mocks from a spec such as OpenAPI.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe command-triggered telemetry sends configured plugin options by default, and those arbitrary values could contain sensitive settings. The source supports a privacy warning, but does not establish secret theft or malicious behavior, so publishing should not be blocked.
Static reason
No blocking static signals were detected.
Trigger
A user runs the Kubb generation command and generation reaches its telemetry reporting step.
Impact
Plugin configuration values leave the user’s environment, creating a risk of unintended disclosure.
Mechanism
The runner passes plugin options into a telemetry payload, which is posted to Kubb’s telemetry endpoint unless an opt-out environment flag is set.
AI rationale
The command-triggered telemetry sends configured plugin options by default, and those arbitrary values could contain sensitive settings. The source supports a privacy warning, but does not establish secret theft or malicious behavior, so publishing should not be blocked.
Evidence
package.jsonbin/kubb.js.lpm-dependency-evidence-6d73edd6-431e-4157-9d94-8c8f03c317a8/0/npm-linux/dist/index.js.lpm-dependency-evidence-6d73edd6-431e-4157-9d94-8c8f03c317a8/0/npm-linux/dist/run-CbX6tpqB.js.lpm-dependency-evidence-6d73edd6-431e-4157-9d94-8c8f03c317a8/0/npm-linux/dist/Telemetry-B3edcFoB.js
Network endpoints1
otlp.kubb.dev/v1/traces
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI that passes user command arguments to the CLI runner.
- After generation, the runner collects every configured plugin’s options for a telemetry report.
- The telemetry builder serializes those option values into the report payload.
- The report is posted to Kubb’s telemetry endpoint; only telemetry opt-out flags suppress the send.
- The CLI displays a telemetry notice and provides an opt-out.
- The package manifest lists build, start, and typecheck scripts, with no install hook.
Evidence against
- The inspected transfer is command-triggered telemetry to a Kubb endpoint; no credential harvesting or separate malicious behavior was identified.
Behavioral surface
EnvironmentVars
Source & flagged code
8 flaggedpackage.jsonView file
40"bin": {
"kubb": "bin/kubb.js"
},
"files": [
"dist",
"bin",
"!/**/**.test.**",
"!/**/__tests__/**",
"!
Medium
Ai Review Evidence
The package exposes a CLI that passes user command arguments to the CLI runner.
package.jsonView on unpkg · L40bin/kubb.jsView file
7try {
const { run } = await import('@kubb/cli')
await run(process.argv.slice(2))
} catch (err) {
console.error(err)
proces
Medium
Ai Review Evidence
After generation, the runner collects every configured plugin’s options for a telemetry report.
bin/kubb.jsView on unpkg · L7.lpm-dependency-evidence-6d73edd6-431e-4157-9d94-8c8f03c317a8/0/npm-linux/dist/run-CbX6tpqB.jsView file
Findings
9 Medium1 Low
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
MediumAi Review Evidencebin/kubb.js
MediumAi Review Evidence.lpm-dependency-evidence-6d73edd6-431e-4157-9d94-8c8f03c317a8/0/npm-linux/dist/run-CbX6tpqB.js
MediumAi Review Evidence.lpm-dependency-evidence-6d73edd6-431e-4157-9d94-8c8f03c317a8/0/npm-linux/dist/Telemetry-B3edcFoB.js
MediumAi Review Evidence.lpm-dependency-evidence-6d73edd6-431e-4157-9d94-8c8f03c317a8/0/npm-linux/dist/Telemetry-B3edcFoB.js
MediumAi Review Evidence.lpm-dependency-evidence-6d73edd6-431e-4157-9d94-8c8f03c317a8/0/npm-linux/dist/Telemetry-B3edcFoB.js
MediumAi Review Evidence.lpm-dependency-evidence-6d73edd6-431e-4157-9d94-8c8f03c317a8/0/npm-linux/dist/index.js
MediumAi Review Evidence.lpm-dependency-evidence-6d73edd6-431e-4157-9d94-8c8f03c317a8/0/npm-linux/dist/Telemetry-B3edcFoB.js
Affected versions and remediation
This report applies to kubb@5.15.0.
See all versions of kubb for other recorded verdicts.
- Review the evidence and your use of kubb@5.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.