registry / @apilift/cli / 1.4.35
@apilift/cli@1.4.35
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe inspected package manifest has no install hook, and the flagged locations did not establish an attack chain. The static hints for credential redirection and remote code execution were not confirmed by inspected source evidence.
Static reason
One or more suspicious static signals were detected.
Trigger
Running an exposed CLI command that uses collection or capture functionality.
Impact
No confirmed attack impact was established.
Mechanism
The inspected code reads agent session paths and evaluates a local worker source string; no malicious network or credential behavior was verified.
AI rationale
The inspected package manifest has no install hook, and the flagged locations did not establish an attack chain. The static hints for credential redirection and remote code execution were not confirmed by inspected source evidence.
Evidence
dist/apilift-collector.jsdist/apilift-session-audit.jsdist/apilift.jsdist/apilift-capture-server.js
Network endpoints1
apilift.dev
Decision evidence
public snapshotAI called this Clean at 62.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI entrypoints and declares no install lifecycle hooks.
- The collector integration location reads Codex and Claude session directories for collection.
- The session-audit integration location is inside a token data table; it does not configure an agent.
- The CLI uses the package's apilift.dev site by default and permits an explicit HTTP(S) site override.
- The capture server evaluates a worker source string locally; inspected evidence does not show remote code being supplied.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/apilift.jsView file
31202// src/process.ts
L31203: import { spawn } from "node:child_process";
L31204: function backgroundOptions(env) {
High
Child Process
Package source references child process execution.
dist/apilift.jsView on unpkg · L3120223396sourceCode = this.opts.code.process(sourceCode, sch);
L23397: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L23398: const validate2 = makeValidate(this, this.scope.get());
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/apilift.js:
transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.o...
if (v.mode === "direct" && !v.baseUrl)
ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Direct transport requires baseUrl" });
if (v.baseUrl && !v.allowedOrigins.includes(parseUrl(v.baseUrl)?.origin ?? ""))
ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Base URL origin must be allowed" });
const keys = kind === "transport" ? ["mode", "baseUrl", "allowedOrigins", "browserContext", "credentials", "inject", "probes"]
Findings
1 Critical4 High3 Medium6 Low
CriticalRemote Response Code Executiondist/apilift-capture-server.js
HighChild Processdist/apilift.js
HighEvaldist/apilift.js
HighCredential Redirect Persistencedist/apilift.js
HighCross File Remote Execution Contextdist/apilift.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @apilift/cli@1.4.35.
See all versions of @apilift/cli for other recorded verdicts.
- Review the evidence and your use of @apilift/cli@1.4.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.