nexgenr@1.2.0
NexgenR — terminal AI coding agent
AI Security Review
scanned 17h ago · by lpm-firewall-aiThe CLI sends runtime telemetry by default, and its README does not disclose that collection. The reviewed fields appear to be runtime and usage context; no credential exfiltration or other attack behavior was identified.
Static reason
No blocking static signals were detected.
Trigger
Normal CLI operation when telemetry is enabled by default; configuration can disable it.
Impact
Usage and runtime metadata are transmitted without disclosure in the README; no credential or content theft was identified.
Mechanism
Telemetry events include device and session identifiers plus runtime and usage context, and the transport supports an endpoint override.
AI rationale
The CLI sends runtime telemetry by default, and its README does not disclose that collection. The reviewed fields appear to be runtime and usage context; no credential exfiltration or other attack behavior was identified.
Evidence
dist/main.mjsREADME.md~/.nexgenr/telemetry
Network endpoints2
ia.nexgen.systemsNEXGENR_TELEMETRY_ENDPOINT
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime telemetry is enabled unless the user sets telemetry to false in configuration.
- Telemetry events include a device ID, session ID, model, app version, platform, OS version, CI flag, locale, and terminal details.
- The telemetry transport accepts NEXGENR_TELEMETRY_ENDPOINT as an endpoint override.
- The README describes the CLI and its API-key setup but does not disclose runtime telemetry.
Evidence against
- The manifest has no install lifecycle scripts; the executable is the CLI entry point.
- The README describes a terminal AI coding agent, and telemetry fields shown are usage and runtime context rather than credentials or file contents.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggeddist/main.mjsView file
•path = dist/main.mjs
kind = oversized_source_file
sizeBytes = 9556487
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/main.mjsView on unpkg•path = dist/main.mjs
kind = oversized_cli_entrypoint
sizeBytes = 9556487
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/main.mjsView on unpkg2001ed`));return t}function qAt(e){let{bootstrap:t}=e,n={app_name:e.appName,client_version:t.clientIdentity.version,version:t.clientIdentity.version,core_version:AAt(),runtime:`node`,platform:t.platform,arch:t.arch,node_version:process.versions.node,os_version:Gt(),ci:t.getEnv(`CI`)!==void 0,locale:e.locale??t.getEnv(`LANG`)??``,terminal:e.terminal??t.getEnv(`TERM_PROGRAM`)??``,ui_mode:e.uiMode??`shell`};return nj(n,`mod
Medium
Ai Review Evidence
Telemetry events include a device ID, session ID, model, app version, platform, OS version, CI flag, locale, and terminal details.
dist/main.mjsView on unpkg · L2001Findings
8 Medium4 Low
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/main.mjs
MediumOversized Cli Entrypointdist/main.mjs
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/main.mjs
MediumAi Review Evidencedist/main.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to nexgenr@1.2.0.
See all versions of nexgenr for other recorded verdicts.
- Review the evidence and your use of nexgenr@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.