registry / neo2-flightpath / 0.3.0
neo2-flightpath@0.3.0
Render flight-path map overlay videos (exactly the source frame rate and frame count) from DJI drone recordings - telemetry from the .SRT sidecar or the embedded CAM-meta (DVTM) stream.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe reviewed network and filesystem behavior supports rendering flight-path videos from user-selected recordings. OpenTelemetry tracing only activates when the user configures an endpoint, and the reviewed spans contain processing metadata rather than recording paths or coordinates.
Static reason
No blocking static signals were detected.
Trigger
Tile requests occur while rendering or previewing a map; tracing requires an endpoint configured by the user in the environment.
Impact
Expected rendering, network requests to map providers, local cache and output writes, and optional trace export; no malicious impact identified.
Mechanism
The app reads recordings selected by the user, fetches basemap tiles, and writes rendered video and tile-cache files. Optional tracing exports processing metadata to the configured OTLP endpoint.
AI rationale
The reviewed network and filesystem behavior supports rendering flight-path videos from user-selected recordings. OpenTelemetry tracing only activates when the user configures an endpoint, and the reviewed spans contain processing metadata rather than recording paths or coordinates.
Evidence
User tile cache (default ~/.cache/neo2-flightpath/tiles; override NEO2_FLIGHTPATH_TILE_CACHE)User-selected video and rendered output paths
Network endpoints3
server.arcgisonline.com/ArcGIS/rest/services/World_Imagery/MapServer/tile/{z}/{y}/{x}{s}.tile.opentopomap.org/{z}/{x}/{y}.pngUser-configured OTLP traces endpoint (OTEL_EXPORTER_OTLP_TRACES_ENDPOINT or OTEL_EXPORTER_OTLP_ENDPOINT)
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a tool for rendering flight-path map videos from DJI recordings.
- Tracing is disabled unless an OpenTelemetry endpoint is set in the environment and the SDK is not disabled.
- Trace attributes report processing counts and modes; no recording paths or GPS coordinates are added in the reviewed spans.
- Map tile requests go to the named Esri and OpenTopoMap tile services, matching the package’s map-rendering purpose.
Evidence against
- The CLI and desktop app process user-selected recordings and generate map-overlay videos, consistent with the package description.
- The default tile cache is local and can be overridden with NEO2_FLIGHTPATH_TILE_CACHE.
- The prepare script runs the package build; no install-time data collection or unrelated network contact was identified.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
2"name": "neo2-flightpath",
"version": "0.3.0",
"description": "Render flight-path map overlay videos (exactly the source frame rate and frame count) from DJI drone recordings - telemetry from th
Low
Ai Review Evidence
The package describes itself as a tool for rendering flight-path map videos from DJI recordings.
package.jsonView on unpkg · L2dist/tracing.jsView file
24}
export function isTracingEnabled(env = process.env) {
const endpoint = envText(env['OTEL_EXPORTER_OTLP_TRACES_ENDPOINT']) ??
envText(env['OTEL_EXPORTER_OTLP_ENDPOINT']);
return endpoint !== undefined && !envFlag(env['OTEL_SDK_DISABLED']);
}
/
Low
Ai Review Evidence
Tracing is disabled unless an OpenTelemetry endpoint is set in the environment and the SDK is not disabled.
dist/tracing.jsView on unpkg · L24dist/run.jsView file
Findings
2 Medium9 Low
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/tracing.js
LowAi Review Evidencedist/run.js
LowAi Review Evidencedist/renderer/tilesources.js
Affected versions and remediation
This report applies to neo2-flightpath@0.3.0.
See all versions of neo2-flightpath for other recorded verdicts.
- Review the evidence and your use of neo2-flightpath@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.