plugins

Install open-plugin format plugins into agent tools

This report shows the evidence for plugins@1.3.6. 0 of 3 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The install telemetry is enabled by default and includes the raw source and plugin names, which may identify local paths or repositories. This is suspicious runtime telemetry; it is opt-out and requires a user-run command, so it does not meet the criteria for malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs an install command and reaches the telemetry call.

Impact

The endpoint can receive local path or repository information and plugin names, despite the README describing the telemetry as anonymous.

Mechanism

The CLI puts the source argument, plugin names, target IDs, and scope into a telemetry request. The source may be a local path or repository URL.

AI rationale

Evidence

dist/index.jsREADME.md

Network endpoints1

plugins-telemetry.labs.vercel.dev/t

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

After an install command, the CLI sends the raw source argument, plugin names, target IDs, and scope as telemetry fields.
The telemetry request goes to https://plugins-telemetry.labs.vercel.dev/t and is enabled unless DISABLE_TELEMETRY or DO_NOT_TRACK is set.
The CLI accepts local directory paths as sources, so telemetry can include a user’s local path; the README describes this telemetry as anonymous.

Evidence against

Telemetry is sent after a user runs an install command; it is not triggered by package installation.
The README documents opt-out environment variables, and the package manifest declares no lifecycle hooks.
The inspected CI check adds a telemetry flag; no gated credential collection or execution behavior was identified.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

4 flagged

dist/index.jsView file

4import { parseArgs } from "util"; L5: import { resolve as resolve4, join as join6 } from "path"; L6: import { execSync as execSync2 } from "child_process"; L7: import { existsSync as existsSync3, rmSync, mkdirSync } from "fs"; ... L305: const content = await readFile(path, "utf-8"); L306: return JSON.parse(content); L307: } catch { ... L322: import { execFileSync } from "child_process"; L323: var HOME = homedir(); L324: function getVsCodeSettingsPath() { L325: const product = detectBinary("code") || !detectBinary("code-insiders") ? "Code" : "Code - Insiders"; L326: if (process.platform === "darwin") {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L4

2694track({ event: "install", source, plugins: selectedPlugins.map((p) => p.name).join(","), pluginCount: String(selectedPlugins.length), targets: installedTargets.map((t) => t.id).join("

Medium

Ai Review Evidence

After an install command, the CLI sends the raw source argument, plugin names, target IDs, and scope as telemetry fields.

dist/index.jsView on unpkg · L2694

2396var TELEMETRY_URL = "https://plugins-telemetry.labs.vercel.dev/t"; var cliVersion = null; funct

Findings

1 High5 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.js

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to plugins@1.3.6.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of plugins@1.3.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 12:32:39.656Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

1.3.6latestshownSuspiciousTelemetryWarnPublishedOct 30, 2026, 1:38 AM 1.3.5Unknown—AllowUnder ReviewOct 13, 2026, 7:02 PM 1.3.4Clean—AllowPublishedJul 13, 2026, 4:19 PM

registry / Telemetry / plugins

plugins

Install open-plugin format plugins into agent tools

This report shows the evidence for plugins@1.3.6. 0 of 3 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs an install command and reaches the telemetry call.

Impact

The endpoint can receive local path or repository information and plugin names, despite the README describing the telemetry as anonymous.

Mechanism

The CLI puts the source argument, plugin names, target IDs, and scope into a telemetry request. The source may be a local path or repository URL.

AI rationale

Evidence

dist/index.jsREADME.md

Network endpoints1

plugins-telemetry.labs.vercel.dev/t

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

After an install command, the CLI sends the raw source argument, plugin names, target IDs, and scope as telemetry fields.
The telemetry request goes to https://plugins-telemetry.labs.vercel.dev/t and is enabled unless DISABLE_TELEMETRY or DO_NOT_TRACK is set.
The CLI accepts local directory paths as sources, so telemetry can include a user’s local path; the README describes this telemetry as anonymous.

Evidence against

Telemetry is sent after a user runs an install command; it is not triggered by package installation.
The README documents opt-out environment variables, and the package manifest declares no lifecycle hooks.
The inspected CI check adds a telemetry flag; no gated credential collection or execution behavior was identified.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

4 flagged

dist/index.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L4

2694track({ event: "install", source, plugins: selectedPlugins.map((p) => p.name).join(","), pluginCount: String(selectedPlugins.length), targets: installedTargets.map((t) => t.id).join("

Medium

Ai Review Evidence

After an install command, the CLI sends the raw source argument, plugin names, target IDs, and scope as telemetry fields.

dist/index.jsView on unpkg · L2694

2396var TELEMETRY_URL = "https://plugins-telemetry.labs.vercel.dev/t"; var cliVersion = null; funct

Findings

1 High5 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/index.js

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to plugins@1.3.6.

The versions list below shows the verdict for each recorded version.

Review the evidence and your use of plugins@1.3.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-31 12:32:39.656Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

1.3.6latestshownSuspiciousTelemetryWarnPublishedOct 30, 2026, 1:38 AM 1.3.5Unknown—AllowUnder ReviewOct 13, 2026, 7:02 PM 1.3.4Clean—AllowPublishedJul 13, 2026, 4:19 PM