portomatic@0.2.5
Slack for testing bots, with the real Slack client.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe authenticated CLI automatically sends account-linked device metadata to the package’s service during normal use, without an evident disclosure or opt-out. This is undisclosed runtime telemetry, while the flagged subprocess output appears to remain local.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An ordinary CLI command after sign-in, or a successful sign-in itself.
Impact
The package service can associate CLI activity and platform details with the signed-in account; this undisclosed runtime telemetry warrants a warning.
Mechanism
The CLI sends the account user ID, device ID, CLI version, platform, and last-seen time in a background request to the package service’s Supabase endpoint.
AI rationale
The authenticated CLI automatically sends account-linked device metadata to the package’s service during normal use, without an evident disclosure or opt-out. This is undisclosed runtime telemetry, while the flagged subprocess output appears to remain local.
Evidence
bin/auth.mjsbin/portomatic.mjs~/.portomatic/device-report.json
Network endpoints1
gimgchyjltruahusntus.supabase.co
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After sign-in, each authenticated CLI invocation reports device and account identifiers, CLI version, platform, and last-seen time to the package service.
- The report runs in the background after successful sign-in and when an existing session is used; no opt-out is shown in these paths.
- The CLI requires sign-in for ordinary commands, making the device report reachable during normal use.
Evidence against
- The report targets the package’s own service and carries account/device metadata rather than credentials or project contents.
- The testing helper’s subprocess output is retained in a bounded in-memory log; the reviewed code does not show it being sent externally.
- The manifest has no install, preinstall, or postinstall hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
7 flaggedproducts/slack/dist/src/cli/start.jsView file
1var E=Object.defineProperty;var a=(o,s)=>E(o,"name",{value:s,configurable:!0});import{Emulator as x}from"../emulator.js";import{SlackTest as k}from"../testing/index.js";import{proj...
L2: `);const p={type:"ready",id:r.id(),apiUrl:i.apiUrl,sharedUrl:d?.url??null};return{emulator:e,slack:i,ready:p}}catch(i){throw await e.close(),i}}a(U,"startManaged");async function e...
High
Child Process
Package source references child process execution.
products/slack/dist/src/cli/start.jsView on unpkg · L1products/slack/dist/src/main.jsView file
1#!/usr/bin/env node
L2: var O=Object.defineProperty;var d=(r,o)=>O(r,"name",{value:o,configurable:!0});var b=function(r,o){return typeof r=="string"&&/^\.\.?\//.test(r)?r.replace(/\.(tsx)$|((?:\.d)?)((?:\...
L3: `)[0]}.`)}})();g=!!o.json,t=e.shift()??"start";const n=d(s=>{if(g)console.log(JSON.stringify({ok:!0,result:s}));else if(s?.type==="ready"||t==="ls"&&Array.isArray(s))for(const i of...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
products/slack/dist/src/main.jsView on unpkg · L1Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltabin/portomatic.mjs
HighChild Processproducts/slack/dist/src/cli/start.js
HighSame File Env Network Executionproducts/slack/dist/src/testing/index.js
HighCommand Output Exfiltrationproducts/slack/dist/src/testing/index.js
HighTrigger Reachable Command Output Exfiltrationproducts/slack/dist/src/testing/index.js
MediumDynamic Requireproducts/slack/dist/src/main.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptoproducts/slack/dist/src/core/avatars.js
LowFilesystem
Affected versions and remediation
This report applies to portomatic@0.2.5.
See all versions of portomatic for other recorded verdicts.
- Review the evidence and your use of portomatic@0.2.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.