registry / oh-langfuse / 0.1.79

oh-langfuse@0.1.79

Use npm scripts to configure Claude Code / OpenCode / Codex with Langfuse tracing.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 20 file(s), 266 KB of source, external domains: 120.46.221.227, gitcode.com, metrics.openharmonyinsight.cn, nodejs.org, pypi.tuna.tsinghua.edu.cn, registry.npmjs.org, registry.npmmirror.com, www.python.org

Source & flagged code

7 flagged

bin/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import fs from "fs";

3import path from "path";

4import readline from "readline";

5import { fileURLToPath } from "url";

6import { spawnSync } from "child_process";

7import { resolveOpencodeCli } from "../scripts/resolve-opencode-cli.mjs";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L5

9const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

10const scriptsDir = path.join(rootDir, "scripts");

12const DEFAULT_LANGFUSE_BASE_URL = "https://metrics.openharmonyinsight.cn";

13const LEGACY_LANGFUSE_BASE_URLS = new Set([

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L5

14 "http://120.46.221.227:3000",

15 "https://120.46.221.227:3000",

16]);

17const DEFAULT_LANGFUSE_PUBLIC_KEY = "pk-lf-da0c90a7-6e93-4eb7-bb86-c1047c8d187d";

18const DEFAULT_LANGFUSE_SECRET_KEY = "sk-lf-0269b85d-bfdc-442c-bfa3-e737954e3315";

19const USER_ID_PATTERN = /^[a-z](?:\d{8}|wx\d{7})$/;

20const USER_ID_PATTERN_TEXT = "^[a-z](?:\\d{8}|wx\\d{7})$";

22function nodeMajorVersion() {

23 const raw = process.versions && process.versions.node ? process.versions.node : "0.0.0";

24 return Number.parseInt(raw.split(".")[0], 10) || 0;

25}

Lines 129-169javascript

129}

130

131function normalizeUserId(v) {

132 return String(v || "").trim();

133}

134

135function isValidUserId(v) {

136 return USER_ID_PATTERN.test(

scripts/opencode-langfuse-setup.mjsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import os from "node:os";

4import { spawn, spawnSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

scripts/auto-update-runtime.mjsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import readline from "node:readline";

4import { spawnSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

codex_langfuse_notify.pyView file

•path = codex_langfuse_notify.py kind = build_helper sizeBytes = 61422 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

codex_langfuse_notify.pyView on unpkg

Source & flagged code

7 flagged · loading source

bin/cli.jsView file

5import { fileURLToPath } from "url"; L6: import { spawnSync } from "child_process"; L7: import { resolveOpencodeCli } from "../scripts/resolve-opencode-cli.mjs";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L5

149const r = isWindowsShellScript L150: ? spawnSync([command, ...args].join(" "), { encoding: "utf8", shell: true }) L151: : spawnSync(command, args, { encoding: "utf8" });

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L149

5import { fileURLToPath } from "url"; L6: import { spawnSync } from "child_process"; L7: import { resolveOpencodeCli } from "../scripts/resolve-opencode-cli.mjs"; ... L11: L12: const DEFAULT_LANGFUSE_BASE_URL = "https://metrics.openharmonyinsight.cn"; L13: const LEGACY_LANGFUSE_BASE_URLS = new Set([ ... L52: L53: const colorEnabled = process.stdout.isTTY && process.env.NO_COLOR !== "1"; L54: const ansi = (code) => (colorEnabled ? `\x1b[${code}m` : ""); ... L108: function clearScreen() { L109: if (process.stdout.isTTY) process.stdout.write("\x1b[2J\x1b[H"); L110: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L5

scripts/opencode-langfuse-setup.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = oh-langfuse@0.1.77 matchedIdentity = npm:b2gtbGFuZ2Z1c2U:0.1.77 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/opencode-langfuse-setup.mjsView on unpkg

3import os from "node:os"; L4: import { spawn, spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url"; ... L13: const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."); L14: const packageJson = JSON.parse(fs.readFileSync(path.join(rootDir, "package.json"), "utf8")); L15: const DEFAULT_LANGFUSE_BASE_URL = "https://metrics.openharmonyinsight.cn"; L16: const LEGACY_LANGFUSE_BASE_URLS = new Set([ ... L64: L65: const colorEnabled = process.stdout.isTTY && process.env.NO_COLOR !== "1"; L66: const ansi = (code) => (colorEnabled ? `\x1b[${code}m` : ""); ... L127: function writeLangfusePluginUserConfig({ userId }) { L128: const home = os.homedir();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/opencode-langfuse-setup.mjsView on unpkg · L3

scripts/auto-update-runtime.mjsView file

3import readline from "node:readline"; L4: import { spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url"; ... L11: const ALLOWED_TARGETS = new Set(["claude", "opencode", "codex"]); L12: const OFFICIAL_NPM_REGISTRY = "https://registry.npmjs.org/"; L13: L14: const colorEnabled = process.stdout.isTTY && process.env.NO_COLOR !== "1"; L15: const ansi = (code) => (colorEnabled ? `\x1b[${code}m` : "");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/auto-update-runtime.mjsView on unpkg · L3

codex_langfuse_notify.pyView file

•path = codex_langfuse_notify.py kind = build_helper sizeBytes = 61422 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

codex_langfuse_notify.pyView on unpkg

Findings

5 High5 Medium5 Low

HighChild Processbin/cli.js

HighShellbin/cli.js

HighSame File Env Network Executionscripts/auto-update-runtime.mjs

HighSandbox Evasion Gated Capabilitybin/cli.js

HighPrevious Version Dangerous Deltascripts/opencode-langfuse-setup.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/opencode-langfuse-setup.mjs

MediumShips Build Helpercodex_langfuse_notify.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

bin/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import fs from "fs";

3import path from "path";

4import readline from "readline";

5import { fileURLToPath } from "url";

6import { spawnSync } from "child_process";

7import { resolveOpencodeCli } from "../scripts/resolve-opencode-cli.mjs";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L5

9const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

10const scriptsDir = path.join(rootDir, "scripts");

12const DEFAULT_LANGFUSE_BASE_URL = "https://metrics.openharmonyinsight.cn";

13const LEGACY_LANGFUSE_BASE_URLS = new Set([

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L5

14 "http://120.46.221.227:3000",

15 "https://120.46.221.227:3000",

16]);

17const DEFAULT_LANGFUSE_PUBLIC_KEY = "pk-lf-da0c90a7-6e93-4eb7-bb86-c1047c8d187d";

18const DEFAULT_LANGFUSE_SECRET_KEY = "sk-lf-0269b85d-bfdc-442c-bfa3-e737954e3315";

19const USER_ID_PATTERN = /^[a-z](?:\d{8}|wx\d{7})$/;

20const USER_ID_PATTERN_TEXT = "^[a-z](?:\\d{8}|wx\\d{7})$";

22function nodeMajorVersion() {

23 const raw = process.versions && process.versions.node ? process.versions.node : "0.0.0";

24 return Number.parseInt(raw.split(".")[0], 10) || 0;

25}

Lines 129-169javascript

129}

130

131function normalizeUserId(v) {

132 return String(v || "").trim();

133}

134

135function isValidUserId(v) {

136 return USER_ID_PATTERN.test(

scripts/opencode-langfuse-setup.mjsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import os from "node:os";

4import { spawn, spawnSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

scripts/auto-update-runtime.mjsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import readline from "node:readline";

4import { spawnSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

codex_langfuse_notify.pyView file

•path = codex_langfuse_notify.py kind = build_helper sizeBytes = 61422 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

codex_langfuse_notify.pyView on unpkg