opik@2.2.116
Opik TypeScript and JavaScript SDK
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection found default-on, opt-out CLI analytics to the package vendor's endpoint, activated by user invocation. The inspected payload and runtime behavior do not establish malicious exfiltration or another concrete attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the Opik CLI; telemetry is enabled by default and can be disabled with OPIK_ANALYTICS_ENABLE.
Impact
The source supports package-aligned usage analytics, not credential or application-record exfiltration.
Mechanism
The CLI posts a workspace-derived or host/user identifier, a limited command and flag summary, and runtime and platform metadata.
AI rationale
Source inspection found default-on, opt-out CLI analytics to the package vendor's endpoint, activated by user invocation. The inspected payload and runtime behavior do not establish malicious exfiltration or another concrete attack.
Evidence
dist/cli.js
Network endpoints1
stats.comet.com
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json maps the SDK and CLI entrypoints and lists build and test scripts; no install lifecycle hook is declared.
- The CLI records invocation and UV status, sends command and flag summaries with runtime metadata to Comet analytics, and allows telemetry to be disabled with OPIK_ANALYTICS_ENABLE.
- The CLI hands the user's arguments to uv to run Opik; its inspected code does not send command output or credentials.
- The SDK entrypoints and inspected dependency sources align with SDK, provider, configuration parsing, and terminal formatting functions.
Evidence against
- The scanner's broad exfiltration label is not supported by the inspected CLI payload, which contains command and flag summaries and runtime metadata, not credentials or rich application records.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
6 flaggeddist/cli.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
High
1#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Findings
1 Critical5 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to opik@2.2.116.
See all versions of opik for other recorded verdicts.
- Review the evidence and your use of opik@2.2.116 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.