nexgenr@1.1.0
NexgenR — terminal AI coding agent
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe bundle enables runtime telemetry by default and collects system-performance metrics, but the README does not disclose this behavior. The code offers opt-outs, and I found no evidence that telemetry sends credentials or file contents, so this warrants a warning rather than a block.
Static reason
No blocking static signals were detected.
Trigger
CLI or web-server startup when telemetry is not disabled in configuration or the environment.
Impact
The service receives usage and machine-performance data without disclosure in the package README; no credential or file-content exfiltration was identified.
Mechanism
The bundled code collects runtime system metrics and sends telemetry events with a persistent device ID to https://ia.nexgen.systems.
AI rationale
The bundle enables runtime telemetry by default and collects system-performance metrics, but the README does not disclose this behavior. The code offers opt-outs, and I found no evidence that telemetry sends credentials or file contents, so this warrants a warning rather than a block.
Evidence
dist/main.mjs~/.nexgenr/telemetry/failed_<random>.jsonl
Network endpoints1
ia.nexgen.systems
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The bundled CLI enables telemetry unless configuration explicitly sets telemetry to false, and sends it to the product telemetry endpoint.
- Telemetry includes process, CPU, memory, and load metrics alongside a persistent device ID.
- The README documents the CLI’s network capabilities but does not disclose telemetry.
Evidence against
- The manifest declares no install lifecycle scripts; the package runs as an explicitly invoked CLI.
- The source provides telemetry opt-outs through configuration and NEXGENR_DISABLE_TELEMETRY.
- The package’s documented purpose involves using its own AI service, so sending the service’s credential to that service is expected.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/main.mjsView file
•path = dist/main.mjs
kind = oversized_source_file
sizeBytes = 17951671
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/main.mjsView on unpkg•path = dist/main.mjs
kind = oversized_cli_entrypoint
sizeBytes = 17951671
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/main.mjsView on unpkgREADME.mdView file
57## What it talks to
| Capability | Endpoint |
|---|---|
| Chat, streaming only | `POST /v1/chat/completions` |
| Model catalog | `GET /v1/models` |
| Health and published limits | `GET /health`, no creden
Medium
Ai Review Evidence
The README documents the CLI’s network capabilities but does not disclose telemetry.
README.mdView on unpkg · L57Findings
8 Medium4 Low
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/main.mjs
MediumOversized Cli Entrypointdist/main.mjs
MediumStructural Risk Force Deep Review
MediumAi Review EvidenceREADME.md
MediumAi Review EvidenceREADME.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to nexgenr@1.1.0.
See all versions of nexgenr for other recorded verdicts.
- Review the evidence and your use of nexgenr@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.