registry / @apilift/cli / 1.4.33
@apilift/cli@1.4.33
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest has no install hook or runtime self-dependency, and inspected credential handling does not establish a hidden fixed-gateway redirect. The scanner’s flagged agent locations resolve to local session path selection and tokenizer vocabulary data, while the collector delivery excerpt shows measurement submission.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI runs its normal commands; measurement delivery requires an existing installation record.
Impact
No unauthorized credential transfer, agent configuration mutation, or other confirmed attack effect was established.
Mechanism
The collector submits execution measurements and baselines to the configured Apilift service. The capture server listens on loopback, and the session-audit target is tokenizer data.
AI rationale
The manifest has no install hook or runtime self-dependency, and inspected credential handling does not establish a hidden fixed-gateway redirect. The scanner’s flagged agent locations resolve to local session path selection and tokenizer vocabulary data, while the collector delivery excerpt shows measurement submission.
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares CLI entrypoints but no install lifecycle hook; its runtime dependencies do not include itself.
- The flagged collector location selects local Codex session paths; its delivery code submits execution measurements and baselines using an installation token.
- The flagged session-audit location contains tokenizer vocabulary fragments, not agent configuration writes.
- The API client sends its supplied token in an authorization header, and the capture server binds to loopback.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/apilift.jsView file
31120// src/process.ts
L31121: import { spawn } from "node:child_process";
L31122: function backgroundOptions(env) {
High
Child Process
Package source references child process execution.
dist/apilift.jsView on unpkg · L31120•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/apilift.js:
transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.o...
if (v.mode === "direct" && !v.baseUrl)
ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Direct transport requires baseUrl" });
if (v.baseUrl && !v.allowedOrigins.includes(parseUrl(v.baseUrl)?.origin ?? ""))
ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Base URL origin must be allowed" });
const keys = kind === "transport" ? ["mode", "baseUrl", "allowedOrigins", "browserContext", "credentials", "inject", "probes"]
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/apilift.jsView on unpkg51Cross-file remote execution chain: dist/apilift.js spawns dist/apilift-capture-server.js; helper contains network access plus dynamic code execution.
L51: attachSchema: () => attachSchema,
L52: base64ToUint8Array: () => base64ToUint8Array,
L53: base64urlToUint8Array: () => base64urlToUint8Array,
...
L1292: }
L1293: return result3.issues.length ? failure(_Err, result3.issues, ctx) : { success: true, data: result3.value };
L1294: };
...
L2163: return false;
L2164: return canParseURL(`http://[${value}]`);
L2165: }
...
L4531: }
L4532: function isRecursive(inst, stack, resolve6) {
L4533: const cached2 = recursive.get(inst);
Findings
1 Critical3 High2 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/apilift-capture-server.js
HighChild Processdist/apilift.js
HighCredential Redirect Persistencedist/apilift.js
HighCross File Remote Execution Contextdist/apilift.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/apilift.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @apilift/cli@1.4.33.
See all versions of @apilift/cli for other recorded verdicts.
- Review the evidence and your use of @apilift/cli@1.4.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.