opik@2.2.137
Opik TypeScript and JavaScript SDK
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends runtime telemetry to Comet’s analytics host by default, and the package README does not disclose it. The inspected payload is limited to an identifier and CLI/runtime metadata, so this is suspicious telemetry rather than credential or command-output exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Running the opik CLI, including when it checks whether uv is available.
Impact
Comet receives persistent workspace or host/user identifiers and CLI usage metadata. No credential or command-output transfer was identified.
Mechanism
The CLI posts events to stats.comet.com with a workspace-derived anonymous ID (or a hash of hostname and username), session ID, command and flag names, SDK and Node versions, platform, architecture, and CI status. Telemetry can be disabled with OPIK_ANALYTICS_ENABLE.
AI rationale
The CLI sends runtime telemetry to Comet’s analytics host by default, and the package README does not disclose it. The inspected payload is limited to an identifier and CLI/runtime metadata, so this is suspicious telemetry rather than credential or command-output exfiltration.
Evidence
dist/cli.js
Network endpoints1
stats.comet.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes dist/cli.js as the opik command.
- Each CLI invocation records an invocation event and detects whether uv is installed.
- CLI telemetry is enabled by default; OPIK_ANALYTICS_ENABLE can disable it.
- Events sent to the analytics endpoint include a workspace-derived anonymous ID and CLI metadata such as command, flags, runtime version, platform, architecture, and CI status.
- When no workspace is configured, the anonymous ID is derived by hashing the hostname and username.
Evidence against
- The telemetry runs when a user invokes the CLI; no install-time telemetry or import-time trigger was identified.
- The inspected event payload contains CLI metadata, not API keys, command output, or file contents.
- The CLI’s uv handoff matches the package’s documented purpose of providing Opik MCP configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
9 flaggeddist/cli.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
High
1#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {randomBytes,createHash}from'crypto';import U,{accessSync,constants}from'fs';import _ from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Findings
1 Critical8 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighKnown Malware Source Similaritydist/cli.js
HighKnown Malware Source Similaritydist/index.cjs
HighKnown Malware Source Fingerprint Signaturedist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to opik@2.2.137.
See all versions of opik for other recorded verdicts.
- Review the evidence and your use of opik@2.2.137 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.