savant-code
Multi-Agent AI Coding Assistant with ECHO Protocol
This report shows the evidence for savant-code@0.0.36. 0 of 16 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe launcher conditionally sends runtime telemetry containing a local home-directory path and update error details to an environment-configured analytics host. This is a privacy risk warranting a warning; the behavior is conditional and does not establish a malicious exfiltration campaign.
Decision evidence
public snapshot- Launcher telemetry is enabled when PostHog API key and host environment variables are present.
- The telemetry payload includes the user's home directory in distinct_id and sends an error message, version, platform, and architecture.
- A failed binary download automatically calls the telemetry function with error and download diagnostics.
- The manifest declares no install, preinstall, or postinstall hook.
- Telemetry is conditional on environment-configured API key and host; the launcher does not hard-code a telemetry destination.
- Downloaded updates are staged and installation is offered for user approval.
Source & flagged code
6 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
launcher.jsView on unpkgFindings
Affected versions and remediation
This report applies to savant-code@0.0.36.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of savant-code@0.0.36 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.