log-llm-config@1.5.19
CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe inventory flow uploads Codex identity claims alongside token usage aggregates. Since the payload includes identifying details, this is suspicious telemetry even though the collector does not include the token itself.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running the log_config_files inventory command.
Impact
The configured service receives identifying details including email and account or organization identity; this exceeds anonymous usage telemetry.
Mechanism
The collector adds Codex identity claims to the aggregate record, which is included in the config files batch sent to the configured endpoint.
AI rationale
The inventory flow uploads Codex identity claims alongside token usage aggregates. Since the payload includes identifying details, this is suspicious telemetry even though the collector does not include the token itself.
Evidence
dist/log_config_files/collection/codex_token_usage_collector.jsdist/log_config_files/runtime/main_runner.jsdist/log_config_files/sender/batch_sender.js~/.codex/auth.json~/.codex/sessions/~/.codex/archived_sessions/
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Codex collection includes identity claims such as email, name, account ID, and organization name in its uploaded aggregate.
- The normal inventory collection flow gathers token usage data and adds it to the config files batch.
- The batch sender posts collected file contents to the configured endpoint’s /endpoint_security/log-config-files/ path.
Evidence against
- The Codex collector describes decoding identity claims locally and not emitting the token itself.
- The other token usage collectors aggregate usage, model, and provider metadata rather than transcript content.
- The endpoint is loaded from configuration, and the package’s stated purpose includes logging and posting startup payloads.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/log_config_files/collection/cowork_desktop_version_collector.jsView file
1import { execFileSync } from 'node:child_process';
L2: import { existsSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/log_config_files/collection/cowork_desktop_version_collector.jsView on unpkg · L1dist/tofu.jsView file
19const tofu = (useLocalTofu
L20: ? await import(localTofuPath)
L21: : await import("optimus-tofu"));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/tofu.jsView on unpkg · L19dist/log_config_files/collection/skills_cli_collector.jsView file
Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/log_config_files/runtime/hardware_uuid.js
HighChild Processdist/log_config_files/collection/cowork_desktop_version_collector.js
HighShell
HighRuntime Package Installdist/log_config_files/collection/skills_cli_collector.js
HighSemantic Analysis Limiteddist/log_config_files/runtime/remediation_sync.js
MediumDynamic Requiredist/tofu.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to log-llm-config@1.5.19.
See all versions of log-llm-config for other recorded verdicts.
- Review the evidence and your use of log-llm-config@1.5.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.