portomatic@0.3.80
Local third-party app sandboxes for agents.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe default postinstall sends install and update telemetry to the package’s own service, so this is warning-level telemetry under the review policy. The reviewed fields are limited to package and runtime metadata; no credential theft or other attack behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm postinstall.
Impact
The publisher receives install metadata without a separate install-time request from the user; this is a privacy risk, but the reviewed fields do not include credentials or project contents.
Mechanism
bin/install.mjs emits install and, when applicable, update events; the telemetry client sends queued events over HTTPS.
AI rationale
The default postinstall sends install and update telemetry to the package’s own service, so this is warning-level telemetry under the review policy. The reviewed fields are limited to package and runtime metadata; no credential theft or other attack behavior was identified.
Evidence
package.jsonbin/install.mjslib/telemetry/client/index.jslib/telemetry/client/identity.js~/.portomatic/device_id~/.portomatic/first_run_pending~/.portomatic/npm-version
Network endpoints1
telemetry.portomatic.com
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package postinstall hook automatically runs bin/install.mjs.
- The install script reports OS, architecture, Node version, CI status, launch type, package manager, and version-change metadata.
- Telemetry is POSTed to telemetry.portomatic.com by default; the code describes collection linked to a random device ID and the sender’s IP address.
- The device ID is generated as a UUID and persisted locally.
Evidence against
- The install event fields are limited to runtime and package-manager metadata; the reviewed install code does not send credential values.
- The telemetry code describes shaping and redacting collected data, including credentials.
- The package’s stated purpose is local third-party app sandboxes for agents.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.postinstall = node bin/install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/install.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgproducts/linear/dist/src/_bundle/entry-0.jsView file
5${files.map(({name})=>join(directory,name)).join(`
L6: `)}`}async function connectorExample(name,out){return writeFiles(await connectorExampleFiles(name),out)}async function connectorExampleFiles(name){if(!connectorExamples.includes(na...
L7: `)+`
High
Child Process
Package source references child process execution.
Findings
2 Critical7 High5 Medium7 Low
CriticalAi Agent Control Hijacklib/telemetry/schemas/shape.json
CriticalPrevious Version Dangerous Deltaproducts/linear/dist/src/_bundle/chunk-GG7KIVZ6.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processproducts/linear/dist/src/_bundle/entry-0.js
HighSame File Env Network Executionproducts/linear/dist/src/_bundle/chunk-GG7KIVZ6.js
HighCommand Output Exfiltrationproducts/linear/dist/src/_bundle/chunk-GG7KIVZ6.js
HighEmbedded Payload Drop Executionproducts/slack/dist/src/_bundle/chunk-7ELRYI4A.js
HighCross File Remote Execution Contextproducts/linear/dist/src/_bundle/entry-0.js
HighSemantic Analysis Limitedproducts/linear/dist/src/_bundle/chunk-2E7ADUAJ.js#virtual:string-array:round1
Affected versions and remediation
This report applies to portomatic@0.3.80.
See all versions of portomatic for other recorded verdicts.
- Review the evidence and your use of portomatic@0.3.80 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.