The @db-tools/main-app npm package version 2026.6.30 includes a preinstall script that runs automatically during installation, invoking a verification script that collects the installer's public egress IP from a Cloudflare endpoint and sends it as user context along with a synthetic exception to a hardcoded Sentry project controlled by the package author. The init() API also defaults to this hardcoded Sentry DSN and enables sending default PII, causing any consumer that does not explicitly configure a DSN to leak application exceptions and PII to the same external project without notification. This behavior is unconditional and non-consensual, representing a privacy and data exfiltration risk.

Users installing or using @db-tools/main-app version 2026.6.30 may have their public IP address and application exception data, including PII, sent to an external author-controlled Sentry project without their knowledge or consent. This can lead to unintended data leakage and privacy violations. There is no indication of remote code execution or system compromise beyond data exfiltration. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid installing or using version 2026.6.30 of @db-tools/main-app. Review and audit dependencies for unexpected preinstall scripts. Explicitly configure the init() function with a trusted DSN or avoid using the package to prevent automatic data exfiltration. Monitor for updates from the package maintainers or security advisories for an official fix.