registry / Data exfiltration / @arohitu/revcloud-cml-cli

@arohitu/revcloud-cml-cli

A CLI tool to automate the deployment of Salesforce Advanced Configurator (CML) configurations.

This report shows the evidence for @arohitu/revcloud-cml-cli@1.3.0. 1 of 11 known versions is blocked or flagged. The newest version, 1.8.0, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Direct source inspection confirms a documented consent gate that is bypassed for headless execution while telemetry remains enabled and sends identifiable Salesforce metadata. This is concrete unconsented exfiltration, not merely a suspicious primitive.

Static reason

One or more suspicious static signals were detected.

Trigger

Run rccml retrieve or deploy in CI/non-interactive mode without --no-telemetry.

Impact

Discloses org ID, username, alias, company, command metrics, locale, and OS details to a third party.

Mechanism

Default telemetry exfiltration after consent bypass

Attack narrative

The package presents telemetry as consent-gated, but its consent function returns without prompting in CI or other non-interactive environments. Successful retrieve/deploy commands then collect Salesforce organization identity fields and unconditionally invoke default-enabled telemetry, which posts them to Aptabase unless the caller already knows to pass --no-telemetry. This is an unconsented data-exfiltration path.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/src/index.jsdist/src/lib/config.jsdist/src/lib/telemetry.jsdist/src/commands/retrieve.jsdist/src/commands/deploy.jsREADME.md~/.rccml/config.jsoncml/

Network endpoints2

eu.aptabase.com/api/v0/eventregistry.npmjs.org/@arohitu/revcloud-cml-cli/latest

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/src/lib/config.js skips consent in CI/non-interactive runs.
dist/src/index.js always tracks retrieve/deploy unless --no-telemetry.
retrieve.js and deploy.js collect Org ID, username, alias, and company.
telemetry.js POSTs those fields to Aptabase by default.
README.md says telemetry occurs after consent, contradicting the headless path.

Evidence against

Salesforce token use is limited to the user-selected org REST API.
postinstall only prompts and stores consent in ~/.rccml/config.json.
The global update command requires an interactive user selection.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 58.7 KB of source, external domains: eu.aptabase.com, registry.npmjs.org, us.aptabase.com

Source & flagged code

5 flagged

package.jsonView file

Lines 1-36json

2 "name": "@arohitu/revcloud-cml-cli",

3 "version": "1.3.0",

4 "description": "A CLI tool to automate the deployment of Salesforce Advanced Configurator (CML) configurations.",

5 "main": "dist/index.js",

6 "bin": {

7 "rccml": "dist/index.js"

8 },

9 "files": [

10 "dist",

11 "scripts",

12 "CHANGELOG.md"

13 ],

14 "scripts": {

15 "build": "rimraf dist && tsc",

16 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "prepublishOnly": "npm run build",

18 "test": "jest --coverage"

19 },

20 "repository": {

21 "type": "git",

22 "url": "git+https://github.com/arohitu/revcloud-cml-cli.git"

23 },

24 "bugs": {

25 "url": "https://github.com/arohitu/revcloud-cml-cli/issues"

26 },

27 "homepage": "https://github.com/arohitu/revcloud-cml-cli#readme",

28 "keywords": [

29 "salesforce",

30 "sfdx",

31 "sf-cli",

32 "cli",

33 "deployment",

34 "expressionset",

35 "advanced-configurator",

36 "cml",

dist/src/lib/sf-util.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.runSfCommand =

dist/src/lib/version-check.jsView file

Lines 1-28javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/lib/sf-util.jsView file

23*/ L24: const child_process_1 = require("child_process"); L25: const util_1 = require("util");

High

Child Process

Package source references child process execution.

dist/src/lib/sf-util.jsView on unpkg · L23

Findings

4 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/src/lib/sf-util.js

HighSame File Env Network Executiondist/src/lib/version-check.js

HighSandbox Evasion Gated Capabilitydist/src/lib/version-check.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @arohitu/revcloud-cml-cli@1.3.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @arohitu/revcloud-cml-cli@1.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 09:52:45.413Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

11 known versions

1.8.0latestSuspicious—WarnPublishedJul 30, 2026, 11:05 AM 1.7.0Suspicious—WarnPublishedJul 15, 2026, 5:05 PM 1.6.0Suspicious—WarnPublishedJul 10, 2026, 4:35 PM 1.5.4Suspicious—WarnPublishedJul 9, 2026, 1:24 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other data exfiltration packages