specbox@6.30.0
Conecta este ordenador a SpecBox sin copiar tokens (specbox login, status y logout) y actualiza los hooks del proyecto sin pisar los tuyos (specbox hooks).
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package has no install-time hook, and heartbeat reporting is limited to projects configured for SpecBox's native board. However, installed hooks automatically send project and session identifiers and work state to the service without a clear user-facing disclosure, so this is suspicious telemetry.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After a user runs specbox hooks update, registered hooks send heartbeat data on session start and user prompt events in eligible projects.
Impact
SpecBox receives identifiable project and work-session status without the README explaining this data flow; the hook can be disabled with SPECBOX_HEARTBEAT=off.
Mechanism
The hook reads the project board ID and session context, then sends project_id, session_id, UC, phase, and waiting state to the SpecBox MCP heartbeat tool using the device authorization helper.
AI rationale
The package has no install-time hook, and heartbeat reporting is limited to projects configured for SpecBox's native board. However, installed hooks automatically send project and session identifiers and work state to the service without a clear user-facing disclosure, so this is suspicious telemetry.
Evidence
hooks/settings-hooks.jsonhooks/session-heartbeat.mjshooks/lib/heartbeat.mjshooks/lib/heartbeat-send.mjsREADME.md.claude/hooks/session-heartbeat.mjs.quality/heartbeat_state.json.quality/.gitignore
Network endpoints1
mcp.specbox.build/mcp
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The hook configuration registers session-heartbeat on session start and user prompt events.
- Heartbeat payloads include project_id, session_id, UC identifier, phase, and waiting state.
- The hook sends the payload to report_session_heartbeat at mcp.specbox.build using the device authorization helper.
- README documents the hooks update command but does not explain the heartbeat data it sends.
Evidence against
- The heartbeat runs only when the project is configured with a native backend and board ID.
- Project hook files and registrations are written only by the explicit specbox hooks update command.
- The destination is SpecBox's own MCP service, and SPECBOX_HEARTBEAT=off disables the heartbeat.
- package.json declares no install, preinstall, or postinstall lifecycle script.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
6 flaggedbin/specbox.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = specbox@6.23.0
matchedIdentity = npm:c3BlY2JveA:6.23.0
similarity = 0.545
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/specbox.mjsView on unpkg13*/
L14: import { execFileSync, spawn } from "node:child_process";
L15: import { realpathSync } from "node:fs";
High
hooks/lib/heartbeat-send.mjsView file
46try {
L47: const modulo = await import(pathToFileURL(ayudante).href);
L48: return (await modulo.headersFor({ env })) || {};
Medium
Findings
1 Critical5 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltabin/specbox.mjs
HighChild Processbin/specbox.mjs
HighShell
HighTrigger Reachable External Ai Agent Control Surface Mutationlib/hooks.mjs
HighRuntime Package Installhooks/post-implement-validate.mjs
HighSemantic Analysis Limitedhooks/app-docs-sync-guard.mjs#virtual:normalized:round1
MediumDynamic Requirehooks/lib/heartbeat-send.mjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to specbox@6.30.0.
See all versions of specbox for other recorded verdicts.
- Review the evidence and your use of specbox@6.30.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.