registry / @apilift/cli / 1.5.1
@apilift/cli@1.5.1
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the inspected high-risk matches resolve to local transcript lookup, tokenizer data, and a bearer-protected loopback service. The source inspected does not establish a concrete attack surface, so the static scanner signals do not support a block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes one of the CLI entrypoints or its local capture service.
Impact
No concrete unauthorized credential transfer, remote code execution, or agent control change was established.
Mechanism
The inspected capture handler checks a bearer token before serving requests; the collector’s agent-related match identifies transcript locations.
AI rationale
The package has no install lifecycle hook, and the inspected high-risk matches resolve to local transcript lookup, tokenizer data, and a bearer-protected loopback service. The source inspected does not establish a concrete attack surface, so the static scanner signals do not support a block.
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares CLI entrypoints and no lifecycle hooks.
- The collector resolves Codex and Claude session directories for transcript lookup; the inspected code does not show an agent configuration write.
- The session-audit match is tokenizer vocabulary data, not an agent configuration operation.
- The CLI uses environment variables for its configurable runtime and plugin paths.
- The native-host file is a bundled CLI entrypoint.
- The capture server requires a bearer token and uses a loopback address.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/apilift.jsView file
76const {workerData}=require('node:worker_threads');
L77: const {spawn}=require('node:child_process');
L78: const state=new Int32Array(workerData.memory,0,4), value=new Float64Array(workerData.memory,16,1);
High
23778sourceCode = this.opts.code.process(sourceCode, sch);
L23779: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L23780: const validate2 = makeValidate(this, this.scope.get());
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/apilift.js:
script = `$ErrorActionPreference='Stop'; while ($null -ne ($line=[Console]::ReadLine())) { $parts=$line.Split('|'); try { $p=[System.Diagnostics.Process]::GetProcessById([int]$part...
import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
writeFileSync(join(directory, "owner.json"), JSON.stringify(owner), { flag: "wx", mode: 384 });
transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.o...
if (v.mode === "direct" && !v.baseUrl)
ctx.addIssue({ cod
Findings
1 Critical4 High3 Medium6 Low
CriticalRemote Response Code Executiondist/apilift-capture-server.js
HighChild Processdist/apilift.js
HighEvaldist/apilift.js
HighCredential Redirect Persistencedist/apilift.js
HighCross File Remote Execution Contextdist/apilift.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @apilift/cli@1.5.1.
See all versions of @apilift/cli for other recorded verdicts.
- Review the evidence and your use of @apilift/cli@1.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.