registry / @arohitu/revcloud-cml-cli / 1.3.0

@arohitu/revcloud-cml-cli@1.3.0

A CLI tool to automate the deployment of Salesforce Advanced Configurator (CML) configurations.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

A non-interactive or CI user running retrieve/deploy has identifying Salesforce organization data sent without consent. The documented consent control is bypassed on that path.

Static reason

One or more suspicious static signals were detected.

Trigger

Run rccml retrieve or deploy in CI/non-interactive mode without --no-telemetry.

Impact

Discloses org ID, username, alias, company, command metrics, locale, and OS details to a third party.

Mechanism

Default telemetry exfiltration after consent bypass

Attack narrative

The package presents telemetry as consent-gated, but its consent function returns without prompting in CI or other non-interactive environments. Successful retrieve/deploy commands then collect Salesforce organization identity fields and unconditionally invoke default-enabled telemetry, which posts them to Aptabase unless the caller already knows to pass --no-telemetry. This is an unconsented data-exfiltration path.

Rationale

Direct source inspection confirms a documented consent gate that is bypassed for headless execution while telemetry remains enabled and sends identifiable Salesforce metadata. This is concrete unconsented exfiltration, not merely a suspicious primitive.

Evidence

package.jsonscripts/postinstall.jsdist/src/index.jsdist/src/lib/config.jsdist/src/lib/telemetry.jsdist/src/commands/retrieve.jsdist/src/commands/deploy.jsREADME.md~/.rccml/config.jsoncml/

@arohitu/revcloud-cml-cli@1.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code