opik@2.2.108
⚠ Under reviewOpik TypeScript and JavaScript SDK
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe inspected CLI telemetry sends invocation metadata to a Comet endpoint, and the scanner’s command-output and credential-exfiltration claims are not supported by that source. Several declared runtime dependencies remain source-unverified, so a clean verdict is not established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Invoking the `opik` CLI activates analytics and, when available, launches `uv tool run opik`.
Impact
The inspected CLI behavior does not establish an attack, but unverified dependency source prevents a clean verdict.
Mechanism
The CLI posts session and invocation metadata to Comet analytics; the inspected source does not show it collecting command output or credentials.
AI rationale
The inspected CLI telemetry sends invocation metadata to a Comet endpoint, and the scanner’s command-output and credential-exfiltration claims are not supported by that source. Several declared runtime dependencies remain source-unverified, so a clean verdict is not established.
Evidence
package.jsondist/cli.js
Network endpoints1
stats.comet.com/notify/event/
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest exposes the SDK bundle and a separate CLI entrypoint, with no install lifecycle hook shown.
- The CLI sends invocation metadata to Comet analytics; its event fields include command and flags, but no command output or credentials.
- The CLI’s child process runs `uv tool run opik` with inherited terminal output.
- Several declared runtime dependencies have metadata-only source coverage, leaving their behavior unresolved.
Evidence against
- The scanner’s claim that the reviewed CLI sends credentials or rich command output is not supported by its request body, which contains session and invocation metadata.
- The CLI analytics setting can be disabled with `OPIK_ANALYTICS_ENABLE=0`, `false`, or `no`.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/cli.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
High
1#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Findings
1 Critical5 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to opik@2.2.108.
See all versions of opik for other recorded verdicts.
- Review the evidence and your use of opik@2.2.108 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.