@apilift/cli@1.6.1
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe CLI permits an unrestricted API-origin override while attaching its saved installation token to requests, creating conditional credential exposure. This supports a warning, but the inspected source does not establish a hidden recipient or an attack when the default service is used.
Static reason
One or more suspicious static signals were detected.
Trigger
Run a linked CLI command with APILIFT_URL pointing to an untrusted origin.
Impact
The configured recipient could receive a reusable Apilift installation token. This exposure is conditional on the operator’s endpoint setting.
Mechanism
The CLI uses APILIFT_URL as its API base and adds the saved installation token as a Bearer credential to requests.
AI rationale
The CLI permits an unrestricted API-origin override while attaching its saved installation token to requests, creating conditional credential exposure. This supports a warning, but the inspected source does not establish a hidden recipient or an attack when the default service is used.
Evidence
dist/apilift.js
Network endpoints1
apilift.dev
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no install lifecycle hook; its listed scripts are build, typecheck, and tests.
- APILIFT_URL can select any HTTP or HTTPS origin; the default is https://apilift.dev.
- The setup flow stores the installation token returned when linking the CLI.
- Later CLI requests use the saved token as a Bearer credential with the selected site as their base URL.
- The separate analytics path accepts only the configured EU PostHog host and a project key with the expected format.
Evidence against
- The source does not establish a fixed unofficial credential recipient or credential theft; exposure depends on an operator setting APILIFT_URL to an untrusted origin.
- The capture server requires a Bearer token and binds to 127.0.0.1; its remote-code-execution hint was not confirmed.
- The package includes ordinary CLI, native-host, session-audit, and pricing-library functionality.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystem
Source & flagged code
5 flaggeddist/apilift.jsView file
76const {workerData}=require('node:worker_threads');
L77: const {spawn}=require('node:child_process');
L78: const state=new Int32Array(workerData.memory,0,4), value=new Float64Array(workerData.memory,16,1);
High
23778sourceCode = this.opts.code.process(sourceCode, sch);
L23779: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L23780: const validate2 = makeValidate(this, this.scope.get());
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/apilift.js:
script = `$ErrorActionPreference='Stop'; while ($null -ne ($line=[Console]::ReadLine())) { $parts=$line.Split('|'); try { $p=[System.Diagnostics.Process]::GetProcessById([int]$part...
external_exports.strictObject({ id, kind: external_exports.literal("replay"), effect, method: external_exports.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]), u...
import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync } from "node:fs";
writeFileSync(join(directory, "owner.json"), JSON.stringify(owner), { flag: "wx", mode: 384 });
transportDefinitionSchema = external_exports.s
Findings
1 Critical4 High3 Medium6 Low
CriticalRemote Response Code Executiondist/apilift-capture-server.js
HighChild Processdist/apilift.js
HighEvaldist/apilift.js
HighCredential Redirect Persistencedist/apilift.js
HighCross File Remote Execution Contextdist/apilift.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @apilift/cli@1.6.1.
See all versions of @apilift/cli for other recorded verdicts.
- Review the evidence and your use of @apilift/cli@1.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.