registry / portomatic / 0.3.77
portomatic@0.3.77
Slack for testing bots, with the real Slack client.
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection confirms automatic, opt-out-free installation telemetry linked to a persistent device identifier. The destination is package-aligned and the observed installation event contains environment metadata, so this supports a warning for privacy exposure rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hook.
Impact
The publisher can associate installation and environment metadata with a persistent device identifier.
Mechanism
The installer emits an installation event containing environment details; telemetry adds persistent device and session identifiers and posts queued events to its configured destination.
AI rationale
Source inspection confirms automatic, opt-out-free installation telemetry linked to a persistent device identifier. The destination is package-aligned and the observed installation event contains environment metadata, so this supports a warning for privacy exposure rather than a malicious verdict.
Evidence
package.jsonbin/install.mjslib/telemetry/client/index.jslib/telemetry/client/identity.jslib/telemetry/client/environment.js
Network endpoints1
telemetry.portomatic.com/v1/events
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook automatically runs an installer that sends installation metadata without an affirmative opt-in.
- The telemetry payload includes a persistent device ID and session ID; the installer also supplies operating system, architecture, Node version, CI status, and package manager.
- The default recipient is the package’s Portomatic telemetry service. The inspected install flow does not include credentials or project content.
Evidence against
- The destination is package-aligned telemetry, and the installer describes its reporting as best effort.
- The inspected installer reports environment and installation metadata, not saved credentials or project files.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node bin/install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/install.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgproducts/slack/dist/src/cli/process.jsView file
1var P=Object.defineProperty;var r=(e,n)=>P(e,"name",{value:n,configurable:!0});import{spawn as x}from"node:child_process";import{setTimeout as L}from"node:timers/promises";import{W...
L2: const { workerData } = require('node:worker_threads');
High
Child Process
Package source references child process execution.
products/slack/dist/src/cli/process.jsFindings
2 Critical4 High5 Medium6 Low
CriticalAi Agent Control Hijackproducts/slack/dist/src/core/commands/views.js
CriticalPrevious Version Dangerous Deltaproducts/slack/dist/src/http/pipeline.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processproducts/slack/dist/src/cli/process.js
HighSame File Env Network Executionproducts/slack/dist/src/testing/index.js
HighCommand Output Exfiltrationproducts/slack/dist/src/testing/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requireproducts/slack/dist/src/connectors/source-hooks.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to portomatic@0.3.77.
See all versions of portomatic for other recorded verdicts.
- Review the evidence and your use of portomatic@0.3.77 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.