runlot@0.1.0-rc.180
runlot CLI — deploy apps and manage PostgreSQL
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe main concern is default-on runtime crash telemetry to Sentry: it sends scrubbed exception details and stacks without an explicit per-run prompt, so I classify it as suspicious telemetry. The flagged credential-redirection concern is not supported by the inspected credential flow, which scopes stored tokens to the selected API origin.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A reportable CLI error, unless telemetry is disabled with RUNLOT_TELEMETRY=0/false/off or DO_NOT_TRACK=1.
Impact
Diagnostic error details and stack information can leave the machine without an explicit per-run consent prompt.
Mechanism
The CLI scrubs error text and command arguments, builds a Sentry envelope, and POSTs it to its configured Sentry ingestion endpoint.
AI rationale
The main concern is default-on runtime crash telemetry to Sentry: it sends scrubbed exception details and stacks without an explicit per-run prompt, so I classify it as suspicious telemetry. The flagged credential-redirection concern is not supported by the inspected credential flow, which scopes stored tokens to the selected API origin.
Evidence
dist/index.js
Network endpoints1
o4512108816105473.ingest.us.sentry.io
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Crash telemetry is enabled by default and can be disabled with RUNLOT_TELEMETRY or DO_NOT_TRACK.
- On reportable errors, the CLI sends a Sentry event to o4512108816105473.ingest.us.sentry.io.
- The event includes scrubbed error messages and stacks, command metadata, and tags; arbitrary error details may still be sent.
Evidence against
- The manifest has no install lifecycle hook; its executable is the CLI at dist/index.js.
- Stored credentials are selected by matching the configured API origin, and login saves credentials for that API.
- Telemetry redacts common secret patterns and home-directory paths, and provides opt-out environment variables.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggeddist/index.jsView file
6const __filename = __runlotFilePath(import.meta.url);
L7: const __dirname = __runlotDirname(__filename);
L8: var __create = Object.create;
...
L47: // ../../packages/api/src/index.ts
L48: function base64urlJson(v) {
L49: const bytes = new TextEncoder().encode(JSON.stringify(v));
...
L54: function gitQuery(ref, path) {
L55: const q = new URLSearchParams();
L56: if (ref !== "") q.set("ref", ref);
...
L126: async request(method, path, init) {
L127: const res = await fetch(new URL(path, this.opts.baseUrl), {
L128: ...init,
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L64288});
L4289: readFromStdout(stdout);
L4290: afterClose(null);
...
L4298: let worker = new worker_threads2.Worker(__filename, {
L4299: workerData: { workerPort, defaultWD, esbuildVersion: "0.24.2" },
L4300: transferList: [workerPort],
L4301: // From node's documentation: https://nodejs.org/api/worker_threads.html
L4302: //
L4303: // Take care when launching worker threads from preload scripts (scripts loaded
L4304: // and run using the `-r` command line flag). Unless the `execArgv` option is
L4305: // explicitly set, new Worker threads automatically inherit the command line flags
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/index.jsView on unpkg · L4288Findings
4 Critical5 High5 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalRemote Response Code Executiondist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighEvaldist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to runlot@0.1.0-rc.180.
See all versions of runlot for other recorded verdicts.
- Review the evidence and your use of runlot@0.1.0-rc.180 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.