modelence@0.29.0
The Node.js Framework for Real-Time MongoDB Apps
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe framework automatically sends project and host identifiers to its own service on startup, and the source provides only an opt-out without disclosing the collection. This is suspicious runtime telemetry, but the reviewed payload does not include credentials or project file contents.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Server initialization; disabled only when MODELENCE_TRACKING_ENABLED is set to false.
Impact
Modelence receives the project and host identifiers for app-start tracking; no credential or file-content collection was identified.
Mechanism
An asynchronous POST reports the project name, package version, local hostname, and environment ID.
AI rationale
The framework automatically sends project and host identifiers to its own service on startup, and the source provides only an opt-out without disclosing the collection. This is suspicious runtime telemetry, but the reviewed payload does not include credentials or project file contents.
Evidence
dist/chunk-2CW7DUZE.js
Network endpoints2
cloud.modelence.com/api/track/app-startConfigured MODELENCE_SERVICE_ENDPOINT/api/track/app-start
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Server initialization invokes the tracking function asynchronously without a separate user action.
- Tracking is enabled by default and POSTs to the Modelence service endpoint at /api/track/app-start.
- The request includes project name, package version, local hostname, and environment ID.
Evidence against
- The telemetry payload contains no credentials or file contents.
- Tracking can be disabled with MODELENCE_TRACKING_ENABLED=false; the endpoint defaults to Modelence or uses the configured service endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
9 flaggeddist/bin/modelence.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = modelence@0.28.0
matchedIdentity = npm:bW9kZWxlbmNl:0.28.0
similarity = 0.917
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/modelence.jsView on unpkg1#!/usr/bin/env node
L2: import {Command,Option}from'commander';import {readFileSync,promises,existsSync,createWriteStream,openAsBlob}from'fs';import {fileURLToPath}from'url';import ve,{join,dirname,relati...
L3: `,{mode:384});}async function Oe(e){let{hosts:t={}}=await V(),o=t[e];return !o?.token||!o.expiresAt||new Date(o.expiresAt).getTime()-oo<=Date.now()?null:o.token}async function _e(e...
High
Child Process
Package source references child process execution.
dist/bin/modelence.jsView on unpkg · L11#!/usr/bin/env node
L2: import {Command,Option}from'commander';import {readFileSync,promises,existsSync,createWriteStream,openAsBlob}from'fs';import {fileURLToPath}from'url';import ve,{join,dirname,relati...
L3: `,{mode:384});}async function Oe(e){let{hosts:t={}}=await V(),o=t[e];return !o?.token||!o.expiresAt||new Date(o.expiresAt).getTime()-oo<=Date.now()?null:o.token}async function _e(e...
Findings
1 Critical8 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/bin/modelence.js
HighChild Processdist/bin/modelence.js
HighShell
HighSame File Env Network Executiondist/bin/modelence.js
HighHost Fingerprint Exfiltrationdist/bin/modelence.js
HighCommand Output Exfiltrationdist/bin/modelence.js
HighSandbox Evasion Gated Capabilitydist/bin/modelence.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/modelence.js
HighSemantic Analysis Limiteddist/chunk-3FQPFORJ.js#virtual:normalized:round1
MediumDynamic Requiredist/chunk-2CW7DUZE.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to modelence@0.29.0.
See all versions of modelence for other recorded verdicts.
- Review the evidence and your use of modelence@0.29.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.