registry / @arohitu/revcloud-cml-cli / 1.2.0

@arohitu/revcloud-cml-cli@1.2.0

A CLI tool to automate the deployment of Salesforce Advanced Configurator (CML) configurations.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a Salesforce CML migration CLI whose shell and network behavior is activated by explicit CLI commands and aligned with its stated purpose.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `rccml list`, `rccml retrieve`, or `rccml deploy`.

Impact

Can read, write, and delete Salesforce CML-related records in the user-selected org when invoked with authenticated Salesforce credentials.

Mechanism

Salesforce CLI orchestration and Salesforce REST API calls

Rationale

The risky primitives are visible and significant, but they implement the advertised Salesforce deployment workflow and require explicit user invocation. I found no install-time execution, hidden endpoint, credential exfiltration, persistence, destructive local behavior, or AI-agent control mutation.

Evidence

package.jsonREADME.mddist/index.jsdist/lib/sf-util.jsdist/lib/file-util.jsdist/commands/retrieve.jsdist/commands/deploy.jsdist/commands/deploy-helpers.jscml/settings.jsoncml/<apiName>/ExpressionSet.jsoncml/<apiName>/ExpressionSetConstraintObj.jsoncml/<apiName>/Product2.jsoncml/<apiName>/ProductClassification.jsoncml/<apiName>/ProductRelatedComponent.json

cml/<apiName>/ProductComponentGroup.json

cml/<apiName>/ExpressionSetDefinitionContextDefinition.json

cml/<apiName>/script.ffxblob

cml/<apiName>/.temp

Network endpoints2

${orgInfo.instanceUrl}/services/data/v${orgInfo.apiVersion}/sobjects/${objectApiName}/${recordId}/${fieldName}${orgInfo.instanceUrl}/services/data/v${orgInfo.apiVersion}/sobjects/${sobjectApiName}/

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/lib/sf-util.js runs shell commands via execPromise(`sf ${command}`) with user-supplied CLI arguments.
dist/lib/sf-util.js obtains Salesforce accessToken from `sf org display` and uses it in Authorization headers.
dist/commands/deploy.js can delete Salesforce ExpressionSetConstraintObj records during explicit deploy cleanup.

Evidence against

package.json has no install/postinstall hook; only prepublishOnly builds before publishing.
dist/index.js only registers commander CLI commands list/retrieve/deploy; no import-time side effects beyond CLI parsing.
Network calls in dist/lib/sf-util.js target the authenticated Salesforce instanceUrl returned by Salesforce CLI.
Filesystem writes are package-aligned under cwd/cml for retrieved configs and deploy temp files.
No credential harvesting, persistence, hidden payload loading, reviewer prompt injection, or non-Salesforce exfiltration found.

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chain

Source & flagged code

1 flagged

dist/lib/sf-util.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arohitu/revcloud-cml-cli@1.1.0 matchedIdentity = npm:[redacted]:1.1.0 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/lib/sf-util.jsView on unpkg

Source & flagged code

1 flagged · loading source

dist/lib/sf-util.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arohitu/revcloud-cml-cli@1.1.0 matchedIdentity = npm:[redacted]:1.1.0 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/lib/sf-util.jsView on unpkg

Findings

1 Critical1 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/lib/sf-util.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LPM CLI

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 43.2 KB of source

Entrypointsmain → dist/index.jsbin → rccml

RuntimeNo engine / OS / CPU constraints

Artifact120 KB · 29 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessFilesystemNetworkHighEntropyStringsManifest: clean

Source & flagged code

1 flagged

dist/lib/sf-util.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arohitu/revcloud-cml-cli@1.1.0 matchedIdentity = npm:[redacted]:1.1.0 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/lib/sf-util.jsView on unpkg