@apilift/cli@1.8.4
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe source shows runtime analytics for CLI activity and a collector that starts by default; the reviewed event data includes command and runtime metadata. I found no evidence that the flagged dynamic worker executes remote code or that credentials are redirected, so this is suspicious telemetry rather than a malicious attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running an eligible CLI command starts the collector and records analytics without an apparent opt-in.
Impact
The publisher and analytics service receive command activity and associated runtime metadata.
Mechanism
A background collector and the CLI analytics module record command and usage events and send analytics to the configured PostHog endpoint.
AI rationale
The source shows runtime analytics for CLI activity and a collector that starts by default; the reviewed event data includes command and runtime metadata. I found no evidence that the flagged dynamic worker executes remote code or that credentials are redirected, so this is suspicious telemetry rather than a malicious attack.
Evidence
dist/apilift.jsdist/apilift-collector.js
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On eligible CLI commands, the package starts its background collector by default; disabling it requires APILIFT_COLLECTOR_DISABLED=1.
- The analytics module defines events for CLI commands, setup, discovery, task observation, and delivery health.
- The CLI records command names, purpose, outcome, duration, agent, platform, and dispatch status in a finished-command analytics event.
Evidence against
- The manifest has no lifecycle scripts; its scripts are build and test commands.
- The reviewed dynamic worker code runs a fixed PowerShell process check to identify Windows process start times; it does not execute remote response content.
- The manifest exposes CLI binaries and a single package entry point.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsPossibleObfuscationTelemetry
Source & flagged code
6 flaggeddist/apilift.jsView file
82const {workerData}=require('node:worker_threads');
L83: const {spawn}=require('node:child_process');
L84: const state=new Int32Array(workerData.memory,0,4), value=new Float64Array(workerData.memory,16,1);
High
23906sourceCode = this.opts.code.process(sourceCode, sch);
L23907: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L23908: const validate2 = makeValidate(this, this.scope.get());
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/apilift.js:
script = `$ErrorActionPreference='Stop'; while ($null -ne ($line=[Console]::ReadLine())) { $parts=$line.Split('|'); try { $p=[System.Diagnostics.Process]::GetProcessById([int]$part...
external_exports.strictObject({ id, kind: external_exports.literal("replay"), effect, method: external_exports.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]), u...
import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync } from "node:fs";
writeFileSync(join(directory, "owner.json"), JSON.stringify(owner), { flag: "wx", mode: 384 });
device_authorization_changed: ["agent", "attem
Findings
2 Critical4 High3 Medium6 Low
CriticalRemote Response Code Executiondist/apilift-capture-server.js
CriticalPrevious Version Dangerous Deltadist/apilift-collector.js
HighChild Processdist/apilift.js
HighEvaldist/apilift.js
HighCredential Redirect Persistencedist/apilift.js
HighCross File Remote Execution Contextdist/apilift.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @apilift/cli@1.8.4.
See all versions of @apilift/cli for other recorded verdicts.
- Review the evidence and your use of @apilift/cli@1.8.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.