opik@2.2.102
Opik TypeScript and JavaScript SDK
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe flagged CLI behavior is first-party usage analytics tied to the package’s publisher and can be disabled. The inspected SDK and CLI sources show no confirmed credential theft, command-output exfiltration, or other malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Invoking the opik CLI triggers analytics events; collection can be disabled with an environment variable.
Impact
Comet receives CLI usage and a derived host identifier for analytics; the inspected payload does not contain credentials or application records.
Mechanism
The CLI posts launcher and runtime metadata, including a hostname-and-username-derived anonymous identifier, to Comet’s stats endpoint.
AI rationale
The flagged CLI behavior is first-party usage analytics tied to the package’s publisher and can be disabled. The inspected SDK and CLI sources show no confirmed credential theft, command-output exfiltration, or other malicious behavior.
Evidence
package.jsondist/cli.jsdist/index.cjsdist/index.d.ts
Network endpoints1
stats.comet.com/notify/event/
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies the Comet Opik SDK, exposes its library and CLI entrypoints, and lists no install lifecycle script.
- The SDK defaults to Comet’s Opik API and uses its configured API key and URL to initialize the client.
- The public client accepts caller-provided trace data through its trace method, consistent with the SDK’s stated purpose.
- The CLI sends usage analytics by default, with an environment variable that disables collection.
- The analytics payload contains launcher metadata and a hostname-and-username-derived anonymous identifier; the inspected payload does not include credentials or application records.
- Analytics are triggered by CLI invocation and posted to Comet’s stats endpoint; the CLI hands off to uv with inherited stdio.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
7 flaggeddist/cli.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {createHash,randomBytes}from'crypto';import L,{accessSync,constants}from'fs';import f from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {createHash,randomBytes}from'crypto';import L,{accessSync,constants}from'fs';import f from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
High
1#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {createHash,randomBytes}from'crypto';import L,{accessSync,constants}from'fs';import f from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Findings
1 Critical6 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighHost Fingerprint Exfiltrationdist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to opik@2.2.102.
See all versions of opik for other recorded verdicts.
- Review the evidence and your use of opik@2.2.102 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.