registry / portomatic / 0.2.7
portomatic@0.2.7
Slack for testing bots, with the real Slack client.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe routed process and network behavior belongs to the bot testing helper, and its command is supplied by the caller. Runtime telemetry is documented, opt-out is available, and the CLI updater verifies signed releases from the package's own host.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI use checks for an update; starting the emulator emits usage telemetry. Bot process execution requires an explicit startBot call with a command.
Impact
No malicious impact was identified. Telemetry is limited to usage metadata, and the testing helper runs the caller-supplied bot command with emulator credentials.
Mechanism
The updater verifies release manifests, while telemetry sends limited usage metadata to Portomatic's telemetry service and documents opt-out controls.
AI rationale
The routed process and network behavior belongs to the bot testing helper, and its command is supplied by the caller. Runtime telemetry is documented, opt-out is available, and the CLI updater verifies signed releases from the package's own host.
Network endpoints3
releases.portomatic.com/cli/latest.jsonreleases.portomatic.com/cli/{version}/portomatic.tgztelemetry.portomatic.com/v1/events
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Slack bot testing emulator and exposes its CLI plus Slack and testing entry points.
- Session telemetry records platform, architecture, Node version, seed type and counts, with environment data reduced to CI and launch categories.
- Built-in product documentation says telemetry sends no messages or credentials and documents opt-out controls.
- The CLI updater uses the Portomatic release host and verifies a signed manifest before accepting a version-specific archive.
- The testing helper spawns the command supplied to startBot and passes it emulator credentials and its local emulator URL.
Evidence against
- The routed testing code combines process, environment and network operations, but its command execution is part of the explicit bot-testing helper; no external forwarding of command output was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
7 flaggedproducts/slack/dist/src/cli/start.jsView file
1var E=Object.defineProperty;var c=(r,o)=>E(r,"name",{value:o,configurable:!0});import{Emulator as x}from"../emulator.js";import{SlackTest as k}from"../testing/index.js";import{proj...
L2: `);const u={type:"ready",id:f.id(),apiUrl:e.apiUrl,sharedUrl:m?.url??null};return{emulator:s,slack:e,ready:u}}catch(e){throw await s.close(),e}}c(v,"startManaged");async function t...
High
Child Process
Package source references child process execution.
products/slack/dist/src/cli/start.jsView on unpkg · L1products/slack/dist/src/main.jsView file
1#!/usr/bin/env node
L2: var O=Object.defineProperty;var m=(r,o)=>O(r,"name",{value:o,configurable:!0});var b=function(r,o){return typeof r=="string"&&/^\.\.?\//.test(r)?r.replace(/\.(tsx)$|((?:\.d)?)((?:\...
L3: `)[0]}.`)}})();g=!!o.json,t=e.shift()??"start";const n=m(s=>{if(g)console.log(JSON.stringify({ok:!0,result:s}));else if(s?.type==="ready"||t==="ls"&&Array.isArray(s))for(const i of...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
products/slack/dist/src/main.jsView on unpkg · L1Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltabin/update.mjs
HighChild Processproducts/slack/dist/src/cli/start.js
HighSame File Env Network Executionproducts/slack/dist/src/testing/index.js
HighCommand Output Exfiltrationproducts/slack/dist/src/testing/index.js
HighTrigger Reachable Command Output Exfiltrationproducts/slack/dist/src/testing/index.js
MediumDynamic Requireproducts/slack/dist/src/main.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptoproducts/slack/dist/src/core/avatars.js
LowFilesystem
Low
Affected versions and remediation
This report applies to portomatic@0.2.7.
See all versions of portomatic for other recorded verdicts.
- Review the evidence and your use of portomatic@0.2.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.