registry / @apilift/cli / 1.5.4
@apilift/cli@1.5.4
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe inspected source does not substantiate the scanner’s credential-redirection or remote-execution claims. The agent integration behavior is tied to an explicit CLI setup action, and the capture server binds to loopback.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the CLI; agent plugin setup requires the setup-continue invocation.
Impact
No confirmed attack impact was established.
Mechanism
The inspected source provides local session collection, a standard-input native host, and a loopback capture server; no confirmed unrelated credential transfer or remote code execution was found.
AI rationale
The inspected source does not substantiate the scanner’s credential-redirection or remote-execution claims. The agent integration behavior is tied to an explicit CLI setup action, and the capture server binds to loopback.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI entrypoints and has no install lifecycle hook.
- The collector match resolves to paths for reading Codex and Claude session files.
- The session-audit match is embedded token text, not an agent configuration write.
- Agent plugin installation is reached through the explicit setup-continue invocation.
- The capture server listens only on the loopback address.
- The native host reads framed input from standard input.
Evidence against
- The flagged capture-server source contains no matching eval, vm, or response-text execution patterns in the inspected searches.
- The CLI selects apilift.dev as its default service host and validates the URL protocol.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
Source & flagged code
5 flaggeddist/apilift.jsView file
76const {workerData}=require('node:worker_threads');
L77: const {spawn}=require('node:child_process');
L78: const state=new Int32Array(workerData.memory,0,4), value=new Float64Array(workerData.memory,16,1);
High
23778sourceCode = this.opts.code.process(sourceCode, sch);
L23779: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L23780: const validate2 = makeValidate(this, this.scope.get());
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/apilift.js:
script = `$ErrorActionPreference='Stop'; while ($null -ne ($line=[Console]::ReadLine())) { $parts=$line.Split('|'); try { $p=[System.Diagnostics.Process]::GetProcessById([int]$part...
import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
writeFileSync(join(directory, "owner.json"), JSON.stringify(owner), { flag: "wx", mode: 384 });
transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.o...
if (v.mode === "direct" && !v.baseUrl)
ctx.addIssue({ cod
Findings
1 Critical4 High3 Medium6 Low
CriticalRemote Response Code Executiondist/apilift-capture-server.js
HighChild Processdist/apilift.js
HighEvaldist/apilift.js
HighCredential Redirect Persistencedist/apilift.js
HighCross File Remote Execution Contextdist/apilift.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @apilift/cli@1.5.4.
See all versions of @apilift/cli for other recorded verdicts.
- Review the evidence and your use of @apilift/cli@1.5.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.