opik@2.2.136
Opik TypeScript and JavaScript SDK
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe CLI sends undisclosed, default-on runtime telemetry to the vendor’s analytics endpoint, including a configured workspace identifier. This is a privacy risk, but the reviewed flow is limited to CLI usage metadata and does not establish credential theft or another malicious attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user invokes the opik CLI; analytics is enabled by default.
Impact
The telemetry can reveal a configured workspace name and associate CLI usage with a stable machine-derived identifier.
Mechanism
The CLI reads OPIK_WORKSPACE or the workspace from ~/.opik.config and sends it as anonymous_id in POST events to stats.comet.com. Without a configured workspace, it derives an ID from hostname and username.
AI rationale
The CLI sends undisclosed, default-on runtime telemetry to the vendor’s analytics endpoint, including a configured workspace identifier. This is a privacy risk, but the reviewed flow is limited to CLI usage metadata and does not establish credential theft or another malicious attack.
Evidence
dist/cli.jsREADME.md~/.opik.config
Network endpoints1
stats.comet.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The CLI enables analytics by default; OPIK_ANALYTICS_ENABLE can disable it.
- On CLI invocation, analytics includes a workspace value as anonymous_id, using OPIK_WORKSPACE or the workspace read from ~/.opik.config; otherwise it derives an ID from hostname and username.
- The CLI posts event data to stats.comet.com, including command names, flag names, runtime version, OS, architecture, and CI status.
- The package README has no mention of analytics, based on searches for “analytics” and “OPIK_ANALYTICS”.
Evidence against
- Analytics runs when a user invokes the CLI, not during installation or package import.
- The CLI records only command and flag names, not their values; the reviewed payload does not include credentials or command output.
- An environment variable allows users to disable analytics.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
9 flaggeddist/cli.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
High
1#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Findings
1 Critical8 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighKnown Malware Source Similaritydist/cli.js
HighKnown Malware Source Similaritydist/index.cjs
HighKnown Malware Source Fingerprint Signaturedist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to opik@2.2.136.
See all versions of opik for other recorded verdicts.
- Review the evidence and your use of opik@2.2.136 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.