opik@2.2.117
Opik TypeScript and JavaScript SDK
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe high-risk scanner labels are not borne out by source inspection: the CLI sends launcher metadata, not command output or credentials, and its subprocess inherits standard I/O. The package has no install hook, and the observed telemetry is tied to explicit CLI invocation and Comet’s own analytics endpoint.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the Opik CLI.
Impact
No attack impact was established; the observed network activity is package-aligned CLI telemetry.
Mechanism
The CLI posts launcher event data, including command and flag metadata, to Comet’s analytics endpoint; an environment setting can disable analytics.
AI rationale
The high-risk scanner labels are not borne out by source inspection: the CLI sends launcher metadata, not command output or credentials, and its subprocess inherits standard I/O. The package has no install hook, and the observed telemetry is tied to explicit CLI invocation and Comet’s own analytics endpoint.
Evidence
dist/cli.js
Network endpoints1
stats.comet.com/notify/event/
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies a Comet SDK, publishes its JavaScript entrypoints and CLI, and lists no install lifecycle hook.
- The inspected SDK entrypoints and required dependency sources show SDK modules and library imports; no attack behavior was established in those files.
- When the CLI is invoked, it sends launcher usage events to Comet’s analytics endpoint. The recorded fields include the command and flags, and analytics can be disabled with an environment setting.
- The CLI checks for uv and then launches the Opik tool with inherited standard I/O; the inspected code does not capture command output for transmission.
Evidence against
- Scanner labels describing credential or command-output exfiltration are not supported by the inspected CLI source: its event payload contains launcher metadata, and its subprocess uses inherited I/O.
- The CLI analytics setting is enabled by default, but this is user-invoked, package-aligned telemetry rather than an install-time disclosure.
Behavioral surface
ChildProcessCrypto
Source & flagged code
6 flaggeddist/cli.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
High
1#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Findings
1 Critical5 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to opik@2.2.117.
See all versions of opik for other recorded verdicts.
- Review the evidence and your use of opik@2.2.117 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.