opik@2.2.135
Opik TypeScript and JavaScript SDK
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI sends default-on usage analytics to Comet and may include a plain workspace identifier from the user's configuration. This is undisclosed runtime telemetry, so the package should be warned rather than blocked.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user runs the Opik CLI; analytics is enabled by default.
Impact
Comet receives CLI usage and a workspace identifier without an evident disclosure in the reviewed package files; users can disable analytics with OPIK_ANALYTICS_ENABLE.
Mechanism
The CLI posts event data to stats.comet.com, including a workspace identifier that may come from OPIK_WORKSPACE or ~/.opik.config, along with command and runtime metadata.
AI rationale
The CLI sends default-on usage analytics to Comet and may include a plain workspace identifier from the user's configuration. This is undisclosed runtime telemetry, so the package should be warned rather than blocked.
Evidence
dist/cli.js
Network endpoints1
stats.comet.com/notify/event/
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI sends analytics to stats.comet.com/notify/event/.
- Analytics is enabled by default unless OPIK_ANALYTICS_ENABLE is set to a disabling value.
- The analytics identifier can be the configured OPIK workspace name or the workspace read from ~/.opik.config.
- Events include the CLI command and flags, runtime and platform details, and a session ID.
- The CLI entry point records an invocation event when it starts.
Evidence against
- The manifest exposes the CLI as a user-run command and the SDK through separate import entry points.
- Provider setup reads an Anthropic API key to configure the Anthropic client; no reviewed evidence showed that key sent to Comet.
- No install lifecycle scripts are declared.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/cli.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
High
1#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Findings
1 Critical8 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighKnown Malware Source Similaritydist/cli.js
HighKnown Malware Source Similaritydist/index.cjs
HighKnown Malware Source Fingerprint Signaturedist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to opik@2.2.135.
See all versions of opik for other recorded verdicts.
- Review the evidence and your use of opik@2.2.135 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.