modelence@0.22.2
The Node.js Framework for Real-Time MongoDB Apps
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is not concretely malicious, but its default runtime telemetry transmits host identity data to a vendor endpoint. The scanner's install-time and arbitrary exfiltration implications are overstated.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting a Modelence application or running modelence deploy
Impact
Discloses hostname, project metadata, and user-selected deployment contents to the configured service.
Mechanism
default startup telemetry and explicit deployment upload
AI rationale
The package is not concretely malicious, but its default runtime telemetry transmits host identity data to a vendor endpoint. The scanner's install-time and arbitrary exfiltration implications are overstated.
Evidence
package.jsondist/chunk-2VYAJGWJ.jsdist/bin/modelence.js.modelence.env.modelence/tmp/bundle.zip.modelence/auth.json
Network endpoints2
cloud.modelence.com/api/track/app-startcloud.modelence.com/api/upload-bundle
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime startup telemetry posts project name, version, local hostname, and environment ID to Modelence Cloud by default.
- The CLI deploy command archives project files and uploads the bundle after an explicit deploy command.
Evidence against
- No preinstall, install, or postinstall hook is declared; prepare only changes Git hooks during source checkout.
- Telemetry has an explicit MODELENCE_TRACKING_ENABLED=false opt-out.
- The CLI's network and file operations are tied to named setup/deploy commands.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
9 flaggeddist/bin/modelence.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
L4: `),console.log(`Successfully configured ${C} file`);}catch(o){console.error(`Setup failed: ${o instanceof Error?o.message:"Unknown error"}`),process.exit(1);}}var X=z.object({serve...
L5: //# sourceMappingURL=modelence.js.map
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/bin/modelence.jsView on unpkg · L11#!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
High
Child Process
Package source references child process execution.
dist/bin/modelence.jsView on unpkg · L11#!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
L4: `),console.log(`Successfully configured ${C} file`);}catch(o){console.error(`Setup failed: ${o instanceof Error?o.message:"Unknown error"}`),process.exit(1);}}var X=z.object({serve...
L5: //# sourceMappingURL=modelence.js.map
Findings
1 Critical7 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/bin/modelence.js
HighChild Processdist/bin/modelence.js
HighSame File Env Network Executiondist/bin/modelence.js
HighHost Fingerprint Exfiltrationdist/chunk-2VYAJGWJ.js
HighEntrypoint Foreign Package Code Overwritedist/bin/modelence.js
HighCommand Output Exfiltrationdist/bin/modelence.js
HighSandbox Evasion Gated Capabilitydist/chunk-2VYAJGWJ.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/modelence.js
MediumDynamic Requiredist/bin/modelence.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to modelence@0.22.2.
See all versions of modelence for other recorded verdicts.
- Review the evidence and your use of modelence@0.22.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.