opik@2.2.100
Opik TypeScript and JavaScript SDK
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no install hook, and the inspected runtime behavior aligns with the Opik SDK and launcher: vendor analytics on explicit CLI invocation and API use configured for Comet. The telemetry is default-enabled and includes a stable host-derived hash, but the inspected source does not establish an attack surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the opik CLI.
Impact
The observed outbound data is CLI and runtime metadata with a hashed host identifier; the source does not establish malicious collection or execution.
Mechanism
The CLI posts launcher events to Comet analytics and hands off to uv; the SDK defaults to the Comet Opik API.
AI rationale
The manifest has no install hook, and the inspected runtime behavior aligns with the Opik SDK and launcher: vendor analytics on explicit CLI invocation and API use configured for Comet. The telemetry is default-enabled and includes a stable host-derived hash, but the inspected source does not establish an attack surface.
Evidence
package.jsondist/cli.jsdist/index.cjsdist/index.jsdist/index.d.ts
Network endpoints2
stats.comet.com/notify/event/www.comet.com/opik/api
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/cli.js as a command and has no install lifecycle hook.
- The SDK uses the Comet Opik API by default, and its public client accepts configuration.
- When the CLI runs, it sends launcher events to Comet analytics with a hashed host and username plus command, flags, and runtime metadata; analytics can be disabled through an environment setting.
- The CLI checks for uv, reports if it is missing, and otherwise hands off to uv to run the Opik tool.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/cli.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {createHash,randomBytes}from'crypto';import L,{accessSync,constants}from'fs';import f from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {createHash,randomBytes}from'crypto';import L,{accessSync,constants}from'fs';import f from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
High
1#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {createHash,randomBytes}from'crypto';import L,{accessSync,constants}from'fs';import f from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Findings
1 Critical6 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighHost Fingerprint Exfiltrationdist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to opik@2.2.100.
See all versions of opik for other recorded verdicts.
- Review the evidence and your use of opik@2.2.100 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.