registry / @actuate-media/cli / 0.12.1

@actuate-media/cli@0.12.1

CLI for Actuate CMS — migrations, codegen, imports, exports, and upgrades

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Risky primitives are tied to explicit CLI subcommands for Actuate CMS project setup, Prisma migrations, update checks, exports, and editor MCP configuration.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs actuate subcommands such as db:init, db:sync, migrate, upgrade, verify, or mcp:init.

Impact

Expected project setup or diagnostics; no unconsented install-time execution or exfiltration observed.

Mechanism

User-invoked CMS project management CLI with Prisma, Vercel, npm registry, and MCP config helpers.

Rationale

Static inspection shows a legitimate Actuate CMS CLI with user-invoked database, update, Vercel, export, and MCP setup actions; scanner hits are explained by package-aligned functionality. No lifecycle execution, credential theft, persistence, destructive payload, or unconsented AI-agent control-surface mutation was found.

Evidence

package.jsondist/index.jsdist/commands/db-status.jsdist/commands/db-init.jsdist/commands/db-sync.jsdist/commands/mcp.jsdist/commands/update-check.jsdist/commands/upgrade.jsdist/commands/doctor.jsdist/vercel/client.jsprisma/schema.prismaprisma/migrations.cursor/mcp.json.vscode/mcp.json.gitignoreuser-specified export output

Network endpoints4

updates.actuatecms.com/api/versionsregistry.npmjs.orgapi.vercel.comuser-provided verify URL

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/commands/mcp.js writes .cursor/.vscode MCP configs, but only when user runs actuate mcp:init.
dist/commands/migrate.js and db-init/db-status/db-sync invoke npx/prisma via user-run CLI commands.

Evidence against

package.json has no lifecycle scripts; bin/main is dist/index.js.
dist/index.js only registers Commander subcommands; no install/import-time execution.
Network use is package-aligned: update checks, npm registry fallback, Vercel env read, or user-provided verify URL.
No credential harvesting or exfiltration found; Vercel token/API key are used for documented CLI configuration/API calls.
Project-file writes are explicit CLI actions: Prisma schema/migrations, package.json upgrades, export output, MCP config.
Dynamic imports resolve cms-core/Prisma helpers from the consumer project for CMS database operations.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 52 file(s), 260 KB of source, external domains: actuatecms.dev, api.vercel.com, example.com, registry.npmjs.org, updates.actuatecms.com, vercel.com, your-site.com

Source & flagged code

4 flagged

dist/commands/db-status.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { readFile, access } from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/commands/db-status.jsView on unpkg · L1

3import { resolve } from 'node:path';

4import ora from 'ora';

5import chalk from 'chalk';

6import { logger } from '../utils/logger.js';

7import { REQUIRED_CMS_MODELS } from '../deployment/diagnostics.js';

8const CMS_SCHEMA_MARKER = '// ── Actuate CMS models';

9async function fileExists(filePath) {

10 try {

11 await access(filePath);

12 return true;

13 }

14 catch {

15 return false;

16 }

17}

18export function registerDbStatusCommand(program) {

19 program

20 .command('db:status')

21 .description('Check which Actuate CMS models are present in your Prisma schema')

Lines 60-100javascript

60 }

61 else {

62 console.log(` ${chalk.red('✗')} ${model} ${chalk.dim('— missing')}`);

63 missing++;

64 }

65 }

66 console.log();

dist/utils/database.jsView file

Lines 1-41javascript

1import { createRequire } from 'node:module';

2import path from 'node:path';

3import { pathToFileURL } from 'node:url';

4import { findLibPrismaHelper, resolveProjectPrismaClientModule } from './prisma-client-path.js';

5/**

6 * Shared helper for CLI commands that need a live connection to the consumer

dist/commands/doctor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @actuate-media/cli@0.12.4 matchedIdentity = npm:QGFjdHVhdGUtbWVkaWEvY2xp:0.12.4 similarity = 0.923 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/commands/db-status.jsView file

1import { execSync } from 'node:child_process'; L2: import { readFile, access } from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/commands/db-status.jsView on unpkg · L1

80spinner.start('Checking database connection...'); L81: execSync('npx prisma db execute --stdin --schema ' + JSON.stringify(schemaPath), { L82: input: 'SELECT 1;',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/db-status.jsView on unpkg · L80

dist/utils/database.jsView file

21export async function connectProjectDatabase() { L22: const { getDB, initDB, isDBInitialized } = await import('@actuate-media/cms-core'); L23: if (isDBInitialized()) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/database.jsView on unpkg · L21

dist/commands/doctor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg

Findings

1 Critical3 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/doctor.js

HighChild Processdist/commands/db-status.js

HighShell

HighRuntime Package Installdist/commands/db-status.js

MediumDynamic Requiredist/utils/database.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/commands/db-status.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { readFile, access } from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/commands/db-status.jsView on unpkg · L1

3import { resolve } from 'node:path';

4import ora from 'ora';

5import chalk from 'chalk';

6import { logger } from '../utils/logger.js';

7import { REQUIRED_CMS_MODELS } from '../deployment/diagnostics.js';

8const CMS_SCHEMA_MARKER = '// ── Actuate CMS models';

9async function fileExists(filePath) {

10 try {

11 await access(filePath);

12 return true;

13 }

14 catch {

15 return false;

16 }

17}

18export function registerDbStatusCommand(program) {

19 program

20 .command('db:status')

21 .description('Check which Actuate CMS models are present in your Prisma schema')

Lines 60-100javascript

60 }

61 else {

62 console.log(` ${chalk.red('✗')} ${model} ${chalk.dim('— missing')}`);

63 missing++;

64 }

65 }

66 console.log();

dist/utils/database.jsView file

Lines 1-41javascript

1import { createRequire } from 'node:module';

2import path from 'node:path';

3import { pathToFileURL } from 'node:url';

4import { findLibPrismaHelper, resolveProjectPrismaClientModule } from './prisma-client-path.js';

5/**

6 * Shared helper for CLI commands that need a live connection to the consumer

dist/commands/doctor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg