nexgenk@1.3.0
NexgenK — terminal AI coding agent
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe CLI enables runtime telemetry by default and the package README does not disclose it. The reviewed code shows usage and device/session metadata collection, but no automatic transmission of credentials, file contents, or command arguments, so this warrants a warning rather than a block.
Decision evidence
public snapshot- The CLI initializes runtime telemetry with telemetry enabled unless the user’s config sets telemetry to false.
- Telemetry uses a Nexgen-controlled endpoint and includes device, session, event, model, and region data.
- The package README search found no telemetry disclosure.
- The manifest describes NexgenK as a terminal AI coding agent and declares no install lifecycle hooks.
- The reviewed telemetry code does not show collection of credentials, file contents, or command arguments.
Source & flagged code
3 flaggedPackage contains source files above the normal full-analysis size ceiling.
dist/main.mjsView on unpkgPackage contains an oversized executable-looking CLI entrypoint.
dist/main.mjsView on unpkgThe CLI initializes runtime telemetry with telemetry enabled unless the user’s config sets telemetry to false.
package.jsonView on unpkg · L2Findings
Affected versions and remediation
This report applies to nexgenk@1.3.0.
See all versions of nexgenk for other recorded verdicts.
- Review the evidence and your use of nexgenk@1.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.