plugins@1.3.6
Install open-plugin format plugins into agent tools
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe install telemetry is enabled by default and includes the raw source and plugin names, which may identify local paths or repositories. This is suspicious runtime telemetry; it is opt-out and requires a user-run command, so it does not meet the criteria for malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs an install command and reaches the telemetry call.
Impact
The endpoint can receive local path or repository information and plugin names, despite the README describing the telemetry as anonymous.
Mechanism
The CLI puts the source argument, plugin names, target IDs, and scope into a telemetry request. The source may be a local path or repository URL.
AI rationale
The install telemetry is enabled by default and includes the raw source and plugin names, which may identify local paths or repositories. This is suspicious runtime telemetry; it is opt-out and requires a user-run command, so it does not meet the criteria for malicious behavior.
Evidence
dist/index.jsREADME.md
Network endpoints1
plugins-telemetry.labs.vercel.dev/t
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After an install command, the CLI sends the raw source argument, plugin names, target IDs, and scope as telemetry fields.
- The telemetry request goes to https://plugins-telemetry.labs.vercel.dev/t and is enabled unless DISABLE_TELEMETRY or DO_NOT_TRACK is set.
- The CLI accepts local directory paths as sources, so telemetry can include a user’s local path; the README describes this telemetry as anonymous.
Evidence against
- Telemetry is sent after a user runs an install command; it is not triggered by package installation.
- The README documents opt-out environment variables, and the package manifest declares no lifecycle hooks.
- The inspected CI check adds a telemetry flag; no gated credential collection or execution behavior was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
4import { parseArgs } from "util";
L5: import { resolve as resolve4, join as join6 } from "path";
L6: import { execSync as execSync2 } from "child_process";
L7: import { existsSync as existsSync3, rmSync, mkdirSync } from "fs";
...
L305: const content = await readFile(path, "utf-8");
L306: return JSON.parse(content);
L307: } catch {
...
L322: import { execFileSync } from "child_process";
L323: var HOME = homedir();
L324: function getVsCodeSettingsPath() {
L325: const product = detectBinary("code") || !detectBinary("code-insiders") ? "Code" : "Code - Insiders";
L326: if (process.platform === "darwin") {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L42694track({
event: "install",
source,
plugins: selectedPlugins.map((p) => p.name).join(","),
pluginCount: String(selectedPlugins.length),
targets: installedTargets.map((t) => t.id).join("
Medium
Ai Review Evidence
After an install command, the CLI sends the raw source argument, plugin names, target IDs, and scope as telemetry fields.
dist/index.jsView on unpkg · L26942396var TELEMETRY_URL = "https://plugins-telemetry.labs.vercel.dev/t";
var cliVersion = null;
funct
Findings
1 High5 Medium6 Low
HighSandbox Evasion Gated Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to plugins@1.3.6.
See all versions of plugins for other recorded verdicts.
- Review the evidence and your use of plugins@1.3.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.