specbox@6.29.2
Conecta este ordenador a SpecBox sin copiar tokens (specbox login, status y logout) y actualiza los hooks del proyecto sin pisar los tuyos (specbox hooks).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package installs event hooks only through an explicit update command, but those hooks send undisclosed runtime telemetry containing project, session and work-state identifiers to SpecBox. The bounded payload, first-party endpoint and opt-out reduce the risk, so this warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After `specbox hooks update` registers the hooks, agent events trigger heartbeats when a native backend and board ID are configured; sends occur at session start/end, on status changes, or at most every two minutes.
Impact
SpecBox receives project and session identifiers and work-state metadata without the README disclosing this telemetry, so users may not expect the reporting.
Mechanism
The hook reads session and project state, builds a structured heartbeat, then sends it with the device authorization header to the SpecBox MCP service. `SPECBOX_HEARTBEAT=off` disables sending.
AI rationale
The package installs event hooks only through an explicit update command, but those hooks send undisclosed runtime telemetry containing project, session and work-state identifiers to SpecBox. The bounded payload, first-party endpoint and opt-out reduce the risk, so this warrants a warning rather than a publish block.
Evidence
hooks/settings-hooks.jsonhooks/session-heartbeat.mjshooks/lib/heartbeat.mjshooks/lib/heartbeat-send.mjs.quality/heartbeat_state.json.quality/.gitignore.quality/heartbeat_error.json.quality/logs/heartbeat.log
Network endpoints1
mcp.specbox.build/mcp
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no install, preinstall or postinstall lifecycle script.
- The documented `specbox hooks update` command installs missing hooks and adds their registrations to project settings.
- The settings template registers the heartbeat hook on agent events; it runs for native projects with a board ID and has an environment-variable opt-out.
- The heartbeat payload includes project, session and active work identifiers plus phase and waiting state, and is sent to SpecBox’s MCP endpoint using the device authorization header.
- The README describes hook installation but does not disclose the heartbeat telemetry.
Evidence against
- The heartbeat only runs when the project is configured with a native backend and board ID; `SPECBOX_HEARTBEAT=off` disables it.
- The transmitted fields are structured project/session status, not conversation text, files or credentials.
- Network traffic goes to the package’s own SpecBox service, and the hooks are installed through an explicit command.
Behavioral surface
ChildProcess
Source & flagged code
6 flaggedbin/specbox.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = specbox@6.23.0
matchedIdentity = npm:c3BlY2JveA:6.23.0
similarity = 0.545
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/specbox.mjsView on unpkg13*/
L14: import { execFileSync, spawn } from "node:child_process";
L15: import { realpathSync } from "node:fs";
High
hooks/lib/heartbeat-send.mjsView file
46try {
L47: const modulo = await import(pathToFileURL(ayudante).href);
L48: return (await modulo.headersFor({ env })) || {};
Medium
Findings
1 Critical5 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltabin/specbox.mjs
HighChild Processbin/specbox.mjs
HighShell
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/hooks.mjs
HighRuntime Package Installhooks/post-implement-validate.mjs
HighSemantic Analysis Limitedhooks/app-docs-sync-guard.mjs#virtual:normalized:round1
MediumDynamic Requirehooks/lib/heartbeat-send.mjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to specbox@6.29.2.
See all versions of specbox for other recorded verdicts.
- Review the evidence and your use of specbox@6.29.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.