opik@2.2.96
Opik TypeScript and JavaScript SDK
AI Security Review
scanned 27d ago · by lpm-firewall-aiSource inspection shows package-aligned launcher telemetry and an Opik tool handoff, with no install lifecycle hook or confirmed attack behavior. The scanner’s credential and record exfiltration claims are not supported by the inspected CLI payload.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the installed opik CLI.
Impact
The inspected behavior supports product telemetry and tool launch; it does not establish credential theft or malicious exfiltration.
Mechanism
The CLI records launcher event metadata and posts it to the analytics endpoint; analytics can be disabled through an environment setting.
AI rationale
Source inspection shows package-aligned launcher telemetry and an Opik tool handoff, with no install lifecycle hook or confirmed attack behavior. The scanner’s credential and record exfiltration claims are not supported by the inspected CLI payload.
Evidence
dist/cli.js
Network endpoints1
stats.comet.com/notify/event/
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to the SDK entrypoints and CLI; its scripts define no install lifecycle hook.
- The CLI sends launcher event metadata to Comet analytics. Its default endpoint is stats.comet.com, and analytics can be disabled with an environment setting.
Evidence against
- The scanner alleges credential and application-record exfiltration, but the inspected CLI payload contains launcher, command, platform, and version metadata; no credential or application-record collection is shown.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {createHash,randomBytes}from'crypto';import L,{accessSync,constants}from'fs';import f from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = opik@2.2.87
matchedIdentity = npm:b3Bpaw:2.2.87
similarity = 0.714
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg1#!/usr/bin/env node
L2: import {spawnSync}from'child_process';import {chalkStderr}from'chalk';import {createHash,randomBytes}from'crypto';import L,{accessSync,constants}from'fs';import f from'os';import i...
L3: ${chalkStderr.red("\u2717")} ${chalkStderr.bold("The Opik MCP configuration requires uv, which is not installed on this machine.")}
Findings
2 Critical6 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighHost Fingerprint Exfiltrationdist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to opik@2.2.96.
See all versions of opik for other recorded verdicts.
- Review the evidence and your use of opik@2.2.96 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.