@apilift/cli@1.7.0
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source shows default background analytics after CLI commands, with an environment-variable opt-out but no clear in-package disclosure. The transmitted data is limited to command metadata and service-assigned identifiers in the inspected code, so this warrants a telemetry warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
A CLI command completes; collection is skipped only in tests or when APILIFT_COLLECTOR_DISABLED=1.
Impact
This exposes command-use metadata and account-linked identifiers to the analytics endpoint without a clear in-package disclosure; the inspected payload does not show credentials or command arguments.
Mechanism
The collector queues command metadata and service-assigned account, workspace and installation IDs, then posts analytics batches when enabled by the service.
AI rationale
The source shows default background analytics after CLI commands, with an environment-variable opt-out but no clear in-package disclosure. The transmitted data is limited to command metadata and service-assigned identifiers in the inspected code, so this warrants a telemetry warning rather than a malicious verdict.
Evidence
dist/apilift.jsdist/apilift-collector.jsstate.sqlite (in the Apilift data directory)
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no install lifecycle scripts and exposes the CLI through dist/apilift.js.
- After a CLI command finishes, the CLI starts a background collector unless the collector is disabled by environment variable.
- Telemetry events include command, purpose, outcome, duration, stage and agent; batches also include account, workspace and installation IDs.
- The collector sends queued analytics to eu.i.posthog.com when the service enables analytics for the installation.
Evidence against
- The collector requires the service-provided analytics setting to be enabled and restricts its host to the EU PostHog endpoint.
- The reviewed telemetry fields contain command metadata and service-assigned IDs; no credential values or command arguments are shown in the reported payload.
- The collector can be disabled with APILIFT_COLLECTOR_DISABLED=1.
- No install hook or automatic install-time network contact is declared.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEval
Source & flagged code
5 flaggeddist/apilift.jsView file
76const {workerData}=require('node:worker_threads');
L77: const {spawn}=require('node:child_process');
L78: const state=new Int32Array(workerData.memory,0,4), value=new Float64Array(workerData.memory,16,1);
High
23778sourceCode = this.opts.code.process(sourceCode, sch);
L23779: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L23780: const validate2 = makeValidate(this, this.scope.get());
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/apilift.js:
script = `$ErrorActionPreference='Stop'; while ($null -ne ($line=[Console]::ReadLine())) { $parts=$line.Split('|'); try { $p=[System.Diagnostics.Process]::GetProcessById([int]$part...
external_exports.strictObject({ id, kind: external_exports.literal("replay"), effect, method: external_exports.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]), u...
import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync } from "node:fs";
writeFileSync(join(directory, "owner.json"), JSON.stringify(owner), { flag: "wx", mode: 384 });
transportDefinitionSchema = external_exports.s
Findings
1 Critical4 High3 Medium6 Low
CriticalRemote Response Code Executiondist/apilift-capture-server.js
HighChild Processdist/apilift.js
HighEvaldist/apilift.js
HighCredential Redirect Persistencedist/apilift.js
HighCross File Remote Execution Contextdist/apilift.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @apilift/cli@1.7.0.
See all versions of @apilift/cli for other recorded verdicts.
- Review the evidence and your use of @apilift/cli@1.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.