registry / portomatic / 0.2.4
portomatic@0.2.4
Slack for testing bots, with the real Slack client.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged command execution is invoked by the package’s bot-testing API, and the new CLI code checks for updates to Portomatic from the npm registry. Account reporting is limited to device-registration metadata after sign-in, and documented usage telemetry has an opt-out; no attack behavior was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI invocation; account registration follows sign-in, while emulator and bot-runner behavior follows the corresponding user command or API call.
Impact
No malicious impact was identified in the reviewed behavior.
Mechanism
The CLI checks the npm registry for its own package updates; authenticated device registration reports account and device metadata; telemetry is documented with an opt-out. The testing helper runs only the command supplied to startBot.
AI rationale
The flagged command execution is invoked by the package’s bot-testing API, and the new CLI code checks for updates to Portomatic from the npm registry. Account reporting is limited to device-registration metadata after sign-in, and documented usage telemetry has an opt-out; no attack behavior was found.
Network endpoints4
registry.npmjs.orggimgchyjltruahusntus.supabase.corelay.portomatic.comtelemetry.portomatic.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hooks; it exposes a CLI and Slack emulator/testing entry points.
- The CLI’s updater checks the npm registry for a newer Portomatic release, and can be disabled with PORTOMATIC_NO_UPDATE=1.
- Device reporting sends the signed-in account’s service-assigned user ID, device ID, CLI version and platform to the Portomatic account service.
- The package documents that usage telemetry contains no messages or credentials and can be disabled with PORTOMATIC_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1.
- The testing library starts a child process only when its startBot method receives a command, and supplies it locally generated emulator credentials.
Evidence against
- No install-time data collection or unrelated collector behavior was identified.
- The flagged command execution is part of an explicitly invoked bot-testing helper.
- The account/device report is limited to device registration metadata and runs through the Portomatic account service after sign-in.
Behavioral surface
ChildProcess
Source & flagged code
7 flaggedproducts/slack/dist/src/cli/run.jsView file
1var T=Object.defineProperty;var s=(r,t)=>T(r,"name",{value:t,configurable:!0});import{spawn as w}from"node:child_process";import{runtimeEnvironment as G}from"../testing/runtime.js"...
High
Child Process
Package source references child process execution.
products/slack/dist/src/cli/run.jsView on unpkg · L1products/slack/dist/src/main.jsView file
1#!/usr/bin/env node
L2: var S=Object.defineProperty;var p=(n,r)=>S(n,"name",{value:r,configurable:!0});var x=function(n,r){return typeof n=="string"&&/^\.\.?\//.test(n)?n.replace(/\.(tsx)$|((?:\.d)?)((?:\...
L3: `)[0]}.`)}})();u=!!r.json,e=o.shift()??"start";const i=p(t=>{if(u)console.log(JSON.stringify({ok:!0,result:t}));else if(t?.type==="ready"||e==="ls"&&Array.isArray(t))for(const a of...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
products/slack/dist/src/main.jsView on unpkg · L1Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltabin/portomatic.mjs
HighChild Processproducts/slack/dist/src/cli/run.js
HighSame File Env Network Executionproducts/slack/dist/src/testing/index.js
HighCommand Output Exfiltrationproducts/slack/dist/src/testing/index.js
HighTrigger Reachable Command Output Exfiltrationproducts/slack/dist/src/testing/index.js
MediumDynamic Requireproducts/slack/dist/src/main.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptoproducts/slack/dist/src/core/avatars.js
LowFilesystem
Low
Affected versions and remediation
This report applies to portomatic@0.2.4.
See all versions of portomatic for other recorded verdicts.
- Review the evidence and your use of portomatic@0.2.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.