registry / Telemetry / openchamber-sogawugu / 1.26.0

openchamber-sogawugu@1.26.0

[![GitHub stars](https://img.shields.io/github/stars/openchamber/openchamber?style=flat&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0iI2YxZWNlYyIgdmlld0JveD0iMCAwIDI1Ni

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The package's update checker sends a persistent install ID and basic runtime metadata to its own service with usage reporting enabled by default. This is limited telemetry rather than exfiltration, but the inspected source does not disclose it or provide a visible opt-out.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

When the application or CLI invokes an update check.

Impact

The service can associate update checks with an installation and its reported runtime metadata.

Mechanism

The update-check request includes platform and version metadata and, by default, a persistent random install ID.

AI rationale

Evidence

server/lib/package-manager.js~/.config/openchamber/install-id-<appType>

Network endpoints1

api.openchamber.dev/v1/update/check

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Update checks report usage by default and include app type, device class, platform, architecture, channel, version, and a persistent install ID.
The payload is POSTed to the package's update-check endpoint.

Evidence against

The reported fields are limited to app and runtime metadata plus a randomly generated install ID; no credentials, local paths, or file contents are included.
Startup persistence is controlled by an explicit startup command; enabling it calls the service-install function.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

NoLicense

Source & flagged code

13 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

•matchType = previous_version_dangerous_delta matchedPackage = openchamber-sogawugu@1.21.6 matchedIdentity = npm:b3BlbmNoYW1iZXItc29nYXd1Z3U:1.21.6 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.test.jsView on unpkg

server/lib/package-manager.jsView file

812stdio: 'inherit', L813: shell: true, L814: ...getSpawnSyncBaseOptions(),

High

Findings

9 High6 Medium8 Low

HighChild Processbin/cli.test.js

HighShellserver/lib/package-manager.js

HighEntrypoint Build Divergenceserver/index.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-BJCZgWJ9.js

HighPrevious Version Dangerous Deltabin/cli.test.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

Medium

Affected versions and remediation

This report applies to openchamber-sogawugu@1.26.0.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.26.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 07:35:20.622Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / openchamber-sogawugu / 1.26.0

openchamber-sogawugu@1.26.0

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

When the application or CLI invokes an update check.

Impact

The service can associate update checks with an installation and its reported runtime metadata.

Mechanism

The update-check request includes platform and version metadata and, by default, a persistent random install ID.

AI rationale

Evidence

server/lib/package-manager.js~/.config/openchamber/install-id-<appType>

Network endpoints1

api.openchamber.dev/v1/update/check

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Update checks report usage by default and include app type, device class, platform, architecture, channel, version, and a persistent install ID.
The payload is POSTed to the package's update-check endpoint.

Evidence against

The reported fields are limited to app and runtime metadata plus a randomly generated install ID; no credentials, local paths, or file contents are included.
Startup persistence is controlled by an explicit startup command; enabling it calls the service-install function.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

NoLicense

Source & flagged code

13 flagged

bin/cli.test.jsView file

6import net from 'net'; L7: import { spawn } from 'child_process'; L8: import { pathToFileURL } from 'url';

High

Child Process

Package source references child process execution.

bin/cli.test.jsView on unpkg · L6

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.test.jsView on unpkg

server/lib/package-manager.jsView file

812stdio: 'inherit', L813: shell: true, L814: ...getSpawnSyncBaseOptions(),

High

Findings

9 High6 Medium8 Low

HighChild Processbin/cli.test.js

HighShellserver/lib/package-manager.js

HighEntrypoint Build Divergenceserver/index.js

HighSame File Env Network Executionserver/lib/opencode/lifecycle.js

HighSandbox Evasion Gated Capabilityserver/lib/cloudflare-tunnel.js

HighTrigger Reachable External Ai Agent Control Surface Mutationserver/lib/opencode/skills.js

HighTrigger Reachable Persistencebin/lib/cli-startup.js

HighSemantic Analysis Limiteddist/assets/useAppFontEffects-BJCZgWJ9.js

HighPrevious Version Dangerous Deltabin/cli.test.js

MediumDynamic Requirebin/lib/commands-serve.js

MediumNetwork

Medium

Affected versions and remediation

This report applies to openchamber-sogawugu@1.26.0.

See all versions of openchamber-sogawugu for other recorded verdicts.

Review the evidence and your use of openchamber-sogawugu@1.26.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-30 07:35:20.622Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.