registry / AI-agent capability abuse / oh-langfuse / 1.1.1

oh-langfuse@1.1.1

Use npm scripts to configure Claude Code / OpenCode / Codex / DeepSeek Harness with Langfuse tracing.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is not an install-time malware chain because the manifest has no lifecycle hook and activation requires an explicit setup command. The package nevertheless persists broad agent telemetry and an automatic updater, so it warrants a warning.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user runs a Claude, Codex, OpenCode, or DSH setup command; later agent activity invokes the installed integration.

Impact

Agent conversation and tool content may be sent to the configured external telemetry service; later updates can fetch and execute a newer package release.

Mechanism

Agent configuration mutation, trace export, and automatic latest-package update.

AI rationale

Evidence

scripts/codex-langfuse-setup.mjscodex_langfuse_notify.pyscripts/auto-update-runtime.mjsscripts/opencode-langfuse-setup.mjs~/.codex/config.toml~/.codex/hooks/codex_langfuse_notify.py~/.codex/langfuse/config.json~/.config/oh-langfuse/bin/oh-langfuse-auto-update-codex~/.config/opencode/opencode.jsonc~/.config/opencode/plugins/opencode-plugin-langfuse

Network endpoints2

metrics.openharmonyhub.cnregistry.npmjs.org

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Explicit setup installs a Codex notify hook and replaces the Codex notify configuration.
The hook reads Codex session records and flushes parsed turns to the configured Langfuse host.
Setup creates a persistent helper that can run the latest release through npx when the packaged runtime is absent.
OpenCode setup installs and patches a plugin, then writes shell-level Langfuse credentials and a command shim.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
The mutations are reached through named setup commands rather than package installation.
The observed collection and export behavior is consistent with the package's tracing function.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

9 flagged

bin/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import fs from "fs";

3import path from "path";

4import readline from "readline";

5import { fileURLToPath } from "url";

6import { spawnSync } from "child_process";

7import { resolveOpencodeCli } from "../scripts/resolve-opencode-cli.mjs";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L5

9const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

10const scriptsDir = path.join(rootDir, "scripts");

12const DEFAULT_LANGFUSE_BASE_URL = "https://metrics.openharmonyhub.cn";

13const LEGACY_LANGFUSE_BASE_URLS = new Set([

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L5

14 "http://metrics.openharmonyinsight.cn",

15 "https://metrics.openharmonyinsight.cn",

16 "http://120.46.221.227:3000",

17 "https://120.46.221.227:3000",

18]);

19const DEFAULT_LANGFUSE_PUBLIC_KEY = "pk-lf-da0c90a7-6e93-4eb7-bb86-c1047c8d187d";

20const DEFAULT_LANGFUSE_SECRET_KEY = "sk-lf-0269b85d-bfdc-442c-bfa3-e737954e3315";

21const USER_ID_PATTERN = /^[a-z]((30|00|60)\d{6}|wx\d{6,})$/;

22const USER_ID_PATTERN_TEXT = "^[a-z]((30|00|60)\\d{6}|wx\\d{6,})$";

24function nodeMajorVersion() {

25 const raw = process.versions && process.versions.node ? process.versions.node : "0.0.0";

Lines 131-171javascript

131}

132

133function normalizeUserId(v) {

134 return String(v || "").trim();

135}

136

137function isValidUserId(v

dsh-langfuse-plugin.jsView file

Lines 550-590javascript

550}

551

552let knownSkillNames = null;

553let knownSkillNamesPromise = null;

554

555async function collectKnownSkillNames() {

556

scripts/auto-update-runtime.mjsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import readline from "node:readline";

4import { spawnSync } from "node:child_process";

scripts/opencode-langfuse-setup.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: c"); } function updateshellconfig({ publickey, secretkey, baseurl, userid, pathprepend = "", runtimeinfo }) { const configpath = getshellconfigpath(); const marker = "# === langfuse opencode setup ==="; const endmarker = "# === end langfuse opencode setup ==="; let content = ""; if (fs.existssync(configpath)) { content = fs.readfilesync(configpath, "utf8"); } const startidx = content.indexof(marker); if (startidx !== -1) { const endidx = content.indexof(endmarker, startidx); if (endidx !== -1) { content = content.slice(0, startidx) + content.slice(endidx + endmarker.length); } }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/opencode-langfuse-setup.mjsView on unpkg

codex_langfuse_notify.pyView file

•path = codex_langfuse_notify.py kind = build_helper sizeBytes = 71864 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

codex_langfuse_notify.pyView on unpkg

scripts/codex-langfuse-setup.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/codex-langfuse-setup.mjs#virtual:normalized:round1View on unpkg

scripts/langfuse-setup.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = oh-langfuse@1.0.0 matchedIdentity = npm:b2gtbGFuZ2Z1c2U:1.0.0 similarity = 0.640 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/langfuse-setup.mjsView on unpkg

Source & flagged code

9 flagged · loading source

bin/cli.jsView file

5import { fileURLToPath } from "url"; L6: import { spawnSync } from "child_process"; L7: import { resolveOpencodeCli } from "../scripts/resolve-opencode-cli.mjs";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L5

151const r = isWindowsShellScript L152: ? spawnSync([command, ...args].join(" "), { encoding: "utf8", shell: true }) L153: : spawnSync(command, args, { encoding: "utf8" });

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L151

5import { fileURLToPath } from "url"; L6: import { spawnSync } from "child_process"; L7: import { resolveOpencodeCli } from "../scripts/resolve-opencode-cli.mjs"; ... L11: L12: const DEFAULT_LANGFUSE_BASE_URL = "https://metrics.openharmonyhub.cn"; L13: const LEGACY_LANGFUSE_BASE_URLS = new Set([ ... L54: L55: const colorEnabled = process.stdout.isTTY && process.env.NO_COLOR !== "1"; L56: const ansi = (code) => (colorEnabled ? `\x1b[${code}m` : ""); ... L110: function clearScreen() { L111: if (process.stdout.isTTY) process.stdout.write("\x1b[2J\x1b[H"); L112: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

Findings

7 High5 Medium5 Low

HighChild Processbin/cli.js

HighShellbin/cli.js

HighSame File Env Network Executionscripts/auto-update-runtime.mjs

HighSandbox Evasion Gated Capabilitybin/cli.js

HighExternal Ai Agent Control Surface Mutationscripts/opencode-langfuse-setup.mjs

HighSemantic Analysis Limitedscripts/codex-langfuse-setup.mjs#virtual:normalized:round1

HighPrevious Version Dangerous Deltascripts/langfuse-setup.mjs

MediumDynamic Requiredsh-langfuse-plugin.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercodex_langfuse_notify.py

MediumStructural Risk Force Deep Review

Low

Affected versions and remediation

This report applies to oh-langfuse@1.1.1.

See all versions of oh-langfuse for other recorded verdicts.

Review the evidence and your use of oh-langfuse@1.1.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 20:09:43.878Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.