kubb@5.15.3
Turn your API spec into type-safe code. Generate TypeScript types, API clients, hooks, validators and mocks from a spec such as OpenAPI.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe CLI dependency discloses runtime telemetry and provides an opt-out, but sends plugin options without filtering them, which can expose project configuration beyond the stated collection. This warrants a warning for telemetry overcollection; no install-time attack was identified.
Static reason
No blocking static signals were detected.
Trigger
A user runs the Kubb CLI command that reports a completed run; telemetry is enabled by default.
Impact
Plugin configuration values could be disclosed to the Kubb telemetry endpoint beyond what the notice says is collected.
Mechanism
The CLI serializes plugin options into its telemetry payload and posts it to otlp.kubb.dev. DO_NOT_TRACK or KUBB_DISABLE_TELEMETRY disables sending.
AI rationale
The CLI dependency discloses runtime telemetry and provides an opt-out, but sends plugin options without filtering them, which can expose project configuration beyond the stated collection. This warrants a warning for telemetry overcollection; no install-time attack was identified.
Evidence
.lpm-dependency-evidence-c9d3992a-8a4f-4f52-8219-84f54542a5b8/0/npm-linux/dist/Telemetry-BTeqnqie.js.lpm-dependency-evidence-c9d3992a-8a4f-4f52-8219-84f54542a5b8/0/npm-linux/dist/index.js
Network endpoints1
otlp.kubb.dev
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI telemetry payload serializes each plugin’s complete options object, which can contain project configuration values.
- The CLI describes its telemetry as anonymous and says it collects no personal data or file contents, but the payload includes unfiltered plugin options.
- When the CLI runs, it sends telemetry to otlp.kubb.dev; users can disable it with DO_NOT_TRACK or KUBB_DISABLE_TELEMETRY.
Evidence against
- The package manifest has no install, preinstall, or postinstall lifecycle script.
- The package’s library entry point only exports Kubb configuration helpers; telemetry is in the CLI dependency.
- The CLI displays a telemetry notice and provides an opt-out.
Behavioral surface
EnvironmentVars
Source & flagged code
4 flagged.lpm-dependency-evidence-c9d3992a-8a4f-4f52-8219-84f54542a5b8/0/npm-linux/dist/Telemetry-BTeqnqie.jsView file
97key: "kubb.plugin_options",
value: { arrayValue: { values: plugins.map((p) => ({ kvlistValue: { values: [{
key: "name",
value: { stringValue: p.name }
}, {
key: "options",
value: { stringValue: JSON.stringify({
...p.options,
usedE
Medium
Ai Review Evidence
The CLI telemetry payload serializes each plugin’s complete options object, which can contain project configuration values.
.lpm-dependency-evidence-c9d3992a-8a4f-4f52-8219-84f54542a5b8/0/npm-linux/dist/Telemetry-BTeqnqie.jsView on unpkg · L97143/**
* Send an OTLP payload to the Kubb endpoint. Respects `DO_NOT_TRACK` and
* `KUBB_DISABLE_TELEMETRY`, and fails silently so telemetry never interrupts a run. No file
* paths, OpenAPI specs, or secrets are sent.
*/
async function sendTelemetry(payload) {
if (isDisabled()) return;
try {
await fetch(`${OTLP_ENDPOINT}/v1/traces`, {
method: "POST",
headers: {
"Content-Type": "application/json",
"Kubb-
Medium
Ai Review Evidence
When the CLI runs, it sends telemetry to otlp.kubb.dev; users can disable it with DO_NOT_TRACK or KUBB_DISABLE_TELEMETRY.
Findings
5 Medium1 Low
MediumEnvironment Vars
MediumAi Review Evidence.lpm-dependency-evidence-c9d3992a-8a4f-4f52-8219-84f54542a5b8/0/npm-linux/dist/Telemetry-BTeqnqie.js
MediumAi Review Evidence.lpm-dependency-evidence-c9d3992a-8a4f-4f52-8219-84f54542a5b8/0/npm-linux/dist/index.js
MediumAi Review Evidence.lpm-dependency-evidence-c9d3992a-8a4f-4f52-8219-84f54542a5b8/0/npm-linux/dist/Telemetry-BTeqnqie.js
MediumAi Review Evidence.lpm-dependency-evidence-c9d3992a-8a4f-4f52-8219-84f54542a5b8/0/npm-linux/dist/index.js
LowScripts Present
Affected versions and remediation
This report applies to kubb@5.15.3.
See all versions of kubb for other recorded verdicts.
- Review the evidence and your use of kubb@5.15.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.