nexgenk@1.6.1
NexgenK — terminal AI coding agent
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package’s default-on runtime telemetry is not disclosed in its README, so it warrants a warning; the inspected events contain metadata rather than prompts, code, credentials, or tool output.
Static reason
No blocking static signals were detected.
Trigger
Starting the CLI with telemetry enabled, which is the default unless configuration or the environment disables it.
Impact
The publisher receives usage and environment metadata without an explicit opt-in.
Mechanism
Batches event metadata and generated device/session identifiers to the telemetry endpoint; failed events may be saved under the home directory’s telemetry folder.
AI rationale
The package’s default-on runtime telemetry is not disclosed in its README, so it warrants a warning; the inspected events contain metadata rather than prompts, code, credentials, or tool output.
Evidence
dist/main.mjs<homeDir>/telemetry
Network endpoints1
ia.nexgen.systems
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI initializes runtime telemetry by default; it can be disabled with config.telemetry=false or NEXGEN_DISABLE_TELEMETRY.
- Telemetry events include generated event IDs, device and session IDs, and app, platform, runtime, CI, locale, terminal, UI mode, and model metadata.
- The configured telemetry endpoint defaults to the publisher’s host, https://ia.nexgen.systems.
Evidence against
- The manifest declares no install or lifecycle hooks.
- The telemetry code redacts common tokens, email addresses, URLs, and user file paths from string properties.
- Telemetry can be disabled through configuration or NEXGEN_DISABLE_TELEMETRY.
- The observed fields are telemetry metadata; no prompt, code, credential, or tool output transfer was identified.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggeddist/main.mjsView file
•path = dist/main.mjs
kind = oversized_source_file
sizeBytes = 9617523
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/main.mjsView on unpkg•path = dist/main.mjs
kind = oversized_cli_entrypoint
sizeBytes = 9617523
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/main.mjsView on unpkg3237eDir:t,deviceId:kf(t,{onFirstLaunch:()=>{e=!0}}),firstLaunch:e}}function Cmr(e){let t=pZ();k9n({homeDir:e.harness.homeDir,deviceId:e.bootstrap.deviceId,enabled:e.config.telemetry!==!1,appName:yZ,version:e.version,uiMode:e.uiMode,model:e.model??e.config.defaultModel,sessionId:e.sessionId,region:t.region,regionSource:t.source,resolveRegion:()=>pZ(),endpoint:()=>mZ().tel
Medium
Ai Review Evidence
The CLI initializes runtime telemetry by default; it can be disabled with config.telemetry=false or NEXGEN_DISABLE_TELEMETRY.
dist/main.mjsView on unpkg · L3237Findings
8 Medium4 Low
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/main.mjs
MediumOversized Cli Entrypointdist/main.mjs
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/main.mjs
MediumAi Review Evidencedist/main.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to nexgenk@1.6.1.
See all versions of nexgenk for other recorded verdicts.
- Review the evidence and your use of nexgenk@1.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.