registry / Telemetry / pando-ai / 1.2.6

pando-ai@1.2.6

pandō gives coding agents a versioned code database, durable node and symbol identities, coordinated MCP operations, and rendered workspaces for builds and tests.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The CLI sends default-on usage telemetry containing operation and project metadata, with an opt-out available through configuration. This is a warning-level privacy risk; the inspected source does not substantiate credential exfiltration or malicious remote execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An MCP tool operation runs while telemetry is enabled.

Impact

The service receives usage and project metadata. The inspected reporting code does not include tool inputs, outputs, credentials, or file contents.

Mechanism

The CLI POSTs operation details, install/session identifiers, an HMAC project hash, and MCP client metadata to the Supabase usage-event endpoint.

AI rationale

Evidence

dist/cli.jsREADME.md~/.pando-ai/config.json~/.pando-ai/install_id

Network endpoints1

ehurtggpaunbndlxuemq.supabase.co

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

MCP operation telemetry is enabled by default unless the saved config disables it, and is posted to a Supabase usage-event endpoint.
Each report can include the operation name, success, duration, counts, install and session IDs, an HMAC project hash, and MCP client name/version.
The README documents a telemetry opt-out, but does not describe the fields collected.

Evidence against

The telemetry reports operation metadata and a hashed project identifier; the inspected code does not show it sending tool inputs, outputs, credentials, or file contents.
The CLI allows telemetry to be disabled with `pando-ai config set telemetry false`.
The flagged gateway code restricts OpenAI traffic to OpenAI or ChatGPT endpoints and Anthropic traffic to Anthropic’s endpoint.
The manifest has no install, preinstall, or postinstall lifecycle scripts.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Source & flagged code

17 flagged

dist/native/ts7/darwin-arm64/api-sync.mjsView file

14523spawn L14524: } from "node:child_process"; L14525: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/native/ts7/darwin-arm64/api-sync.mjsView on unpkg · L14523

dist/workers/chunk-X543BOTA.mjsView file

4${f}`)}}));let n=await o.loadWebAssemblyModule(await r,{loadAsync:!0}),s=Object.keys(n),a=s.find(c=>ln.test(c)&&!c.includes("external_scanner_"));if(!a)throw console.log(`Couldn't ... L5: ${JSON.stringify(s,null,2)}`),new Error("Language.load failed: no language function found in WASM file");let l=n[a]();return new Kt(se,l)}},cn=(()=>{var _scriptName=import.meta.url... L6: `)}catch{}}var jn=Number(process.env.PANDO_PYTHON_WORKER_PARSE_TIMEOUT_MS||18e4),qn=Number(process.env.PANDO_PYTHON_WORKER_RESOLVE_TIMEOUT_MS||18e4),be=class extends Error{construc...

High

Eval

Package source references dynamic code evaluation.

dist/workers/chunk-X543BOTA.mjsView on unpkg · L4

Findings

4 Critical9 High6 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalCredential Exfiltrationdist/cli.js

CriticalRemote Response Code Executiondist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/native/ts7/darwin-arm64/api-sync.mjs

HighEvaldist/workers/chunk-X543BOTA.mjs

HighCredential Redirect Persistencedist/cli.js

HighCommand Output Exfiltrationdist/workers/chunk-X543BOTA.mjs

HighObfuscated Payload Loaderdist/cli.js

HighTrigger Reachable Credential Exfiltrationdist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

Affected versions and remediation

This report applies to pando-ai@1.2.6.

See all versions of pando-ai for other recorded verdicts.

Review the evidence and your use of pando-ai@1.2.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 23:44:59.556Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Telemetry / pando-ai / 1.2.6

pando-ai@1.2.6

pandō gives coding agents a versioned code database, durable node and symbol identities, coordinated MCP operations, and rendered workspaces for builds and tests.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An MCP tool operation runs while telemetry is enabled.

Impact

The service receives usage and project metadata. The inspected reporting code does not include tool inputs, outputs, credentials, or file contents.

Mechanism

The CLI POSTs operation details, install/session identifiers, an HMAC project hash, and MCP client metadata to the Supabase usage-event endpoint.

AI rationale

Evidence

dist/cli.jsREADME.md~/.pando-ai/config.json~/.pando-ai/install_id

Network endpoints1

ehurtggpaunbndlxuemq.supabase.co

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

MCP operation telemetry is enabled by default unless the saved config disables it, and is posted to a Supabase usage-event endpoint.
Each report can include the operation name, success, duration, counts, install and session IDs, an HMAC project hash, and MCP client name/version.
The README documents a telemetry opt-out, but does not describe the fields collected.

Evidence against

The telemetry reports operation metadata and a hashed project identifier; the inspected code does not show it sending tool inputs, outputs, credentials, or file contents.
The CLI allows telemetry to be disabled with `pando-ai config set telemetry false`.
The flagged gateway code restricts OpenAI traffic to OpenAI or ChatGPT endpoints and Anthropic traffic to Anthropic’s endpoint.
The manifest has no install, preinstall, or postinstall lifecycle scripts.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Source & flagged code

17 flagged

dist/native/ts7/darwin-arm64/api-sync.mjsView file

14523spawn L14524: } from "node:child_process"; L14525: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/native/ts7/darwin-arm64/api-sync.mjsView on unpkg · L14523

dist/workers/chunk-X543BOTA.mjsView file

High

Eval

Package source references dynamic code evaluation.

dist/workers/chunk-X543BOTA.mjsView on unpkg · L4

Findings

4 Critical9 High6 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalCredential Exfiltrationdist/cli.js

CriticalRemote Response Code Executiondist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

HighChild Processdist/native/ts7/darwin-arm64/api-sync.mjs

HighEvaldist/workers/chunk-X543BOTA.mjs

HighCredential Redirect Persistencedist/cli.js

HighCommand Output Exfiltrationdist/workers/chunk-X543BOTA.mjs

HighObfuscated Payload Loaderdist/cli.js

HighTrigger Reachable Credential Exfiltrationdist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

Affected versions and remediation

This report applies to pando-ai@1.2.6.

See all versions of pando-ai for other recorded verdicts.

Review the evidence and your use of pando-ai@1.2.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-29 23:44:59.556Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface