nexgenk@1.4.1
NexgenK — terminal AI coding agent
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe bundled CLI initializes runtime telemetry by default and reports host resource metrics and system context to the vendor service. The README documents product API traffic but does not disclose telemetry, so this is a warning-level privacy risk.
Static reason
No blocking static signals were detected.
Trigger
Automatically when CLI telemetry initializes during use; telemetry is on by default unless disabled.
Impact
Exposes system and usage metadata without clear disclosure in the package README.
Mechanism
Collects environment and runtime context plus periodic process and host resource metrics, then POSTs event payloads to the configured telemetry endpoint.
AI rationale
The bundled CLI initializes runtime telemetry by default and reports host resource metrics and system context to the vendor service. The README documents product API traffic but does not disclose telemetry, so this is a warning-level privacy risk.
Evidence
dist/main.mjs~/.nexgenk/telemetry/*.jsonl
Network endpoints1
ia.nexgen.systems
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The npm executable points to dist/main.mjs.
- The README documents chat, model catalog, search, and fetch traffic but does not disclose telemetry.
- Runtime telemetry is enabled unless disabled in config or through NEXGEN_DISABLE_TELEMETRY; it reports OS version, locale, terminal, model, and build SHA, plus periodic CPU, memory, and load metrics.
- The telemetry transport sends event payloads to the NexgenK service endpoint https://ia.nexgen.systems.
Evidence against
- The package is a terminal AI coding agent, and its documented API traffic serves that purpose.
- The telemetry has configuration and environment-variable opt-outs, and the inspected events do not include prompts or credentials.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
4 flaggeddist/main.mjsView file
•path = dist/main.mjs
kind = oversized_source_file
sizeBytes = 18025938
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/main.mjsView on unpkg•path = dist/main.mjs
kind = oversized_cli_entrypoint
sizeBytes = 18025938
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/main.mjsView on unpkgpackage.jsonView file
16"bin": {
"nexgenk": "dist/main.mjs"
},
"files
Medium
Findings
8 Medium4 Low
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/main.mjs
MediumOversized Cli Entrypointdist/main.mjs
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
MediumAi Review EvidenceREADME.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to nexgenk@1.4.1.
See all versions of nexgenk for other recorded verdicts.
- Review the evidence and your use of nexgenk@1.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.