registry / oh-langfuse / 0.2.3

oh-langfuse@0.2.3

Use npm scripts to configure Claude Code / OpenCode / Codex with Langfuse tracing.

Static Scan Results

scanned 22d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 21 file(s), 284 KB of source, external domains: 120.46.221.227, gitcode.com, metrics.openharmonyinsight.cn, nodejs.org, opencode.ai, pypi.tuna.tsinghua.edu.cn, registry.npmjs.org, registry.npmmirror.com, www.python.org

Source & flagged code

9 flagged

bin/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import fs from "fs";

3import path from "path";

4import readline from "readline";

5import { fileURLToPath } from "url";

6import { spawnSync } from "child_process";

7import { resolveOpencodeCli } from "../scripts/resolve-opencode-cli.mjs";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L5

9const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

10const scriptsDir = path.join(rootDir, "scripts");

12const DEFAULT_LANGFUSE_BASE_URL = "https://metrics.openharmonyinsight.cn";

13const LEGACY_LANGFUSE_BASE_URLS = new Set([

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L5

14 "http://120.46.221.227:3000",

15 "https://120.46.221.227:3000",

16]);

17const DEFAULT_LANGFUSE_PUBLIC_KEY = "pk-lf-da0c90a7-6e93-4eb7-bb86-c1047c8d187d";

18const DEFAULT_LANGFUSE_SECRET_KEY = "sk-lf-0269b85d-bfdc-442c-bfa3-e737954e3315";

19const USER_ID_PATTERN = /^[a-z](?:\d{8}|wx\d{7})$/;

20const USER_ID_PATTERN_TEXT = "^[a-z](?:\\d{8}|wx\\d{7})$";

22function nodeMajorVersion() {

23 const raw = process.versions && process.versions.node ? process.versions.node : "0.0.0";

24 return Number.parseInt(raw.split(".")[0], 10) || 0;

25}

Lines 129-169javascript

129}

130

131function normalizeUserId(v) {

132 return String(v || "").trim();

133}

134

135function isValidUserId(v

scripts/opencode-langfuse-setup.mjsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import os from "node:os";

4import { spawn, spawnSync } from "node:child_process";

scripts/auto-update-runtime.mjsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import readline from "node:readline";

4import { spawnSync } from "node:child_process";

scripts/codex-langfuse-setup.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: nst verifycontent = fs.readfilesync(configpath, "utf8"); const notifymatch = verifycontent.match(/^notify\s*=\s*\[[\s\s]*?\]/m); if (!notifymatch) { throw new error(`failed to write valid notify config to ${configpath}. generated content:\n${result}`); } } async function main() { const args = parseargs(process.argv.slice(2)); const rootdir = packageroot; const packagejson = json.parse(fs.readfilesync(path.join(rootdir, "package.json"), "utf8")); const publickey = args.publickey || process.env.langfuse_public_key || "pk-lf-da0c90a7-6e93-4eb7-bb86-c1047c8d187d"; const secretkey = args.secretkey || process.env.langfuse_secret_key || "sk[redacted]"; const b

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/codex-langfuse-setup.mjsView on unpkg

codex_langfuse_notify.pyView file

•path = codex_langfuse_notify.py kind = build_helper sizeBytes = 70139 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

codex_langfuse_notify.pyView on unpkg

scripts/langfuse-setup.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = oh-langfuse@0.2.2 matchedIdentity = npm:b2gtbGFuZ2Z1c2U:0.2.2 similarity = 0.955 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/langfuse-setup.mjsView on unpkg

Source & flagged code

9 flagged · loading source

bin/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code