neo2-flightpath@0.2.0
Render flight-path map overlay videos (exactly the source frame rate and frame count) from DJI drone recordings - telemetry from the .SRT sidecar or the embedded CAM-meta (DVTM) stream.
AI Security Review
scanned 6d ago · by lpm-firewall-aiTracing is opt-in and exports to the collector the user configures, but its spans include a video basename that the documentation does not disclose. This is a limited telemetry privacy concern, so the package merits a warning rather than a block.
Decision evidence
public snapshot- Tracing is disabled unless an OTLP endpoint is configured; an enabled trace uses that configured collector.
- Recording spans include the input video’s basename as the `source.file.name` attribute.
- The README says trace attributes contain counts and distances only, leaving the video basename undisclosed.
- The README documents OpenTelemetry tracing and explains how to enable it with standard environment variables.
- The package’s other network requests fetch map tiles from the listed map providers, consistent with its rendering purpose.
- The inspected trace attributes do not include flight coordinates.
Source & flagged code
4 flaggedA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/render.js#virtual:normalized:round1View on unpkgTracing is disabled unless an OTLP endpoint is configured; an enabled trace uses that configured collector.
dist/tracing.jsView on unpkg · L23Findings
Affected versions and remediation
This report applies to neo2-flightpath@0.2.0.
See all versions of neo2-flightpath for other recorded verdicts.
- Review the evidence and your use of neo2-flightpath@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.