prettier-plugin-solidity-import-order@1.0.0
Prettier plugin that sorts Solidity import statements into a deterministic order. Sorting is opt-in: enable with importOrder: true in your Prettier options.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe plugin performs runtime telemetry by default in CI and sends identifying host and project details to a hard-coded endpoint. This is suspicious telemetry because the README’s description does not disclose those fields.
Decision evidence
public snapshot- The package collects the host name, current working directory, CI runner and repository metadata.
- On import, it sends a POST to 157.254.194.31 when CI is detected, unless an opt-out variable is set.
- The README calls the ping anonymous and says it contains toolchain versions only, which does not match the collected identifying fields.
- The manifest has no lifecycle scripts, and the CI-only ping has opt-out variables.
- The plugin’s stated purpose is to sort Solidity imports, and sorting is opt-in.
Source & flagged code
5 flaggedThe package collects the host name, current working directory, CI runner and repository metadata.
index.jsView on unpkg · L14On import, it sends a POST to 157.254.194.31 when CI is detected, unless an opt-out variable is set.
index.jsView on unpkg · L11Findings
Affected versions and remediation
This report applies to prettier-plugin-solidity-import-order@1.0.0.
See all versions of prettier-plugin-solidity-import-order for other recorded verdicts.
- Review the evidence and your use of prettier-plugin-solidity-import-order@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.