registry / @athsra/cli / 1.2.4

@athsra/cli@1.2.4

athsra CLI — E2EE secret manager on Cloudflare edge. Doppler-style dev UX + zero-knowledge encryption + soft-delete + version history. MIT.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Network, keyring, child_process, and MCP behavior are package-aligned secret-manager features activated by explicit CLI/MCP use, not install-time or import-time execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs athsra CLI commands such as login, run, or mcp install --apply.

Impact

No unconsented execution, exfiltration, persistence, or foreign AI-agent control-surface mutation found.

Mechanism

User-invoked secret manager CLI with guarded MCP integration and OIDC login

Rationale

Scanner reverse-shell and sandbox-evasion hints map to an OIDC browser flow, loopback callback, update check, and user-invoked command execution for secret env injection. MCP registration can write Claude/Cursor/VS Code config only through an explicit dry-run-by-default command with --apply, so it does not meet the unconsented lifecycle hijack policy.

Evidence

package.jsonsrc/index.tssrc/lib/oidc-flow.tssrc/commands/login.tssrc/commands/mcp.tssrc/lib/mcp-register.tssrc/commands/run.tssrc/lib/mcp-tools/run.tssrc/lib/config.tssrc/lib/client.tssrc/lib/update-check.tssrc/lib/workers-builds.ts

Network endpoints4

login.modfolio.io/.well-known/openid-configurationconnect.modfolio.ioregistry.npmjs.org/@athsra/cli/latestapi.cloudflare.com/client/v4

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; bin is user-invoked src/index.ts
src/lib/oidc-flow.ts uses loopback HTTP callback plus browser opener for OIDC PKCE, not reverse-shell socket piping
src/commands/mcp.ts install is explicit, dry-run by default, and requires --apply before writing MCP client config
MCP write/admin/value tools are gated by ATHSRA_MCP_WRITE, ATHSRA_MCP_ADMIN, or ATHSRA_MCP_READ_VALUES
src/commands/run.ts and src/lib/mcp-tools/run.ts execute user-supplied commands to inject package-managed secrets, with reserved env key blocking
src/lib/config.ts rejects non-HTTPS worker URLs except localhost before sending bearer tokens

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 486 KB of source, external domains: 127.0.0.1, api.cloudflare.com, athsra-worker.winterermod.workers.dev, athsra.com, connect.modfolio.io, github.com, login.modfolio.io, registry.npmjs.org

Source & flagged code

5 flagged

src/lib/oidc-flow.tsView file

Lines 1-30typescript

1/**

2 * oidc-flow.ts — modfolio-connect SSO 의 OIDC PKCE 브라우저 플로우 (Phase 2.8).

3 *

4 * `commands/login.ts` 에서 분리 (2026-06-02 리팩토링) — 프로토콜 무관 OAuth redirect 기계 부분

5 * (PKCE 생성 → loopback callback → /token 교환)을 독립 모듈로. login.ts 는 athsra 고유 셸

6 * (keyring·config·worker /auth/sso 교환·master pw)만 유지. 동작·출력·exit code 보존 (순수 추출).

7 *

8 * `openBrowser` 는 device-login (login.ts deviceLoginCmd) 도 사용 — 여기서 export (중복 사본 금지).

9 */

11import { spawn } from 'node:child_process';

12import { createHash, randomBytes } from 'node:crypto';

High

Child Process

Package source references child process execution.

src/lib/oidc-flow.tsView on unpkg · L10

13import { readFileSync } from 'node:fs';

14import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';

15import { errMessage, isRecord } from './err.ts';

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

src/lib/oidc-flow.tsView on unpkg · L5

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/lib/oidc-flow.tsView on unpkg · L5

17/** OIDC PKCE 플로우 엔드포인트 + 파라미터 (endpoint 는 discovery 로 해석 후 주입). */

18export interface OidcFlowOptions {

19 /** Connect authorize endpoint (discovery 로 해석된 값) */

20 authorizeUrl: string;

21 /** Connect token endpoint (discovery 로 해석된 값) */

22 tokenUrl: string;

23 /** Connect 측 CLI client (PKCE public, no secret) */

24 clientId: string;

25 /** OIDC scope */

26 scope: string;

27 /** callback timeout (ms) — 사용자 browser 작업 대기 */

28 callbackTimeoutMs: number;

29}

Lines 261-301typescript

261 if (settled) return;

262 settled = true;

263 if (timer) clearTimeout(timer);

264 reject(err instanceof Error ? err : new Error(String(err)));

265 });

266 server.listen

src/commands/login.tsView file

Lines 62-102typescript

62 * 3) browser open → Connect /authorize

63 * 4) callback ?code= → POST Connect /token (code + verifier) → access_token

64 * 5) POST worker /auth/sso (access_token + label) → athsra Bearer token

Source & flagged code

5 flagged · loading source

src/lib/oidc-flow.tsView file

5* (PKCE 생성 → loopback callback → /token 교환)을 독립 모듈로. login.ts 는 athsra 고유 셸 L6: * (keyring·config·worker /auth/sso 교환·master pw)만 유지. 동작·출력·exit code 보존 (순수 추출). L7: * ... L10: L11: import { spawn } from 'node:child_process'; L12: import { createHash, randomBytes } from 'node:crypto'; L13: import { readFileSync } from 'node:fs'; L14: import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'; L15: import { errMessage, isRecord } from './err.ts'; ... L96: if (res.ok) { L97: const doc: unknown = await res.json(); L98: if (hasOidcEndpoints(doc)) {

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

src/lib/oidc-flow.tsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> src/index.ts -> src/commands/login.ts -> src/lib/oidc-flow.ts L5: * (PKCE 생성 → loopback callback → /token 교환)을 독립 모듈로. login.ts 는 athsra 고유 셸 L6: * (keyring·config·worker /auth/sso 교환·master pw)만 유지. 동작·출력·exit code 보존 (순수 추출). L7: * ... L10: L11: import { spawn } from 'node:child_process'; L12: import { createHash, randomBytes } from 'node:crypto'; L13: import { readFileSync } from 'node:fs'; L14: import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'; L15: import { errMessage, isRecord } from './err.ts'; ... L96: if (res.ok) { L97: const doc: unknown = await res.json(); L98: if (hasOidcEndpoints(doc)) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/lib/oidc-flow.tsView on unpkg · L5

10L11: import { spawn } from 'node:child_process'; L12: import { createHash, randomBytes } from 'node:crypto';

High

Child Process

Package source references child process execution.

src/lib/oidc-flow.tsView on unpkg · L10

281const platform = process.platform; L282: // WSL — Linux 플랫폼이지만 xdg-open 이 호스트 브라우저로 연결 안 됨. wslview/powershell 폴백. L283: if (platform === 'linux' && isWsl()) {

High

Shell

Package source references shell execution.

src/lib/oidc-flow.tsView on unpkg · L281

src/commands/login.tsView file

82const existing = loadConfig(); L83: const envUrl = process.env.ATHSRA_WORKER_URL; L84: const workerUrl = ... L86: envUrl ?? L87: (await promptText('Worker URL', 'https://athsra-worker.winterermod.workers.dev')); L88: const machineId = existing?.machineId ?? `${hostname()}-${Date.now().toString(36)}`; L89: ... L127: headers: { 'content-type': 'application/json' }, L128: body: JSON.stringify({ access_token: accessToken, label: machineId }), L129: }); L130: if (!ssoRes.ok) { L131: console.error(`✗ athsra worker SSO failed: ${ssoRes.status} ${await ssoRes.text()}`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/login.tsView on unpkg · L82

Findings

2 Critical3 High3 Medium4 Low

CriticalReverse Shellsrc/lib/oidc-flow.ts

CriticalTrigger Reachable Dangerous Capabilitysrc/lib/oidc-flow.ts

HighChild Processsrc/lib/oidc-flow.ts

HighShellsrc/lib/oidc-flow.ts

HighSandbox Evasion Gated Capabilitysrc/commands/login.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

src/lib/oidc-flow.tsView file

Lines 1-30typescript

1/**

2 * oidc-flow.ts — modfolio-connect SSO 의 OIDC PKCE 브라우저 플로우 (Phase 2.8).

3 *

4 * `commands/login.ts` 에서 분리 (2026-06-02 리팩토링) — 프로토콜 무관 OAuth redirect 기계 부분

5 * (PKCE 생성 → loopback callback → /token 교환)을 독립 모듈로. login.ts 는 athsra 고유 셸

6 * (keyring·config·worker /auth/sso 교환·master pw)만 유지. 동작·출력·exit code 보존 (순수 추출).

7 *

8 * `openBrowser` 는 device-login (login.ts deviceLoginCmd) 도 사용 — 여기서 export (중복 사본 금지).

9 */

11import { spawn } from 'node:child_process';

12import { createHash, randomBytes } from 'node:crypto';

High

Child Process

Package source references child process execution.

src/lib/oidc-flow.tsView on unpkg · L10

13import { readFileSync } from 'node:fs';

14import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';

15import { errMessage, isRecord } from './err.ts';

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

src/lib/oidc-flow.tsView on unpkg · L5

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/lib/oidc-flow.tsView on unpkg · L5

17/** OIDC PKCE 플로우 엔드포인트 + 파라미터 (endpoint 는 discovery 로 해석 후 주입). */

18export interface OidcFlowOptions {

19 /** Connect authorize endpoint (discovery 로 해석된 값) */

20 authorizeUrl: string;

21 /** Connect token endpoint (discovery 로 해석된 값) */

22 tokenUrl: string;

23 /** Connect 측 CLI client (PKCE public, no secret) */

24 clientId: string;

25 /** OIDC scope */

26 scope: string;

27 /** callback timeout (ms) — 사용자 browser 작업 대기 */

28 callbackTimeoutMs: number;

29}

Lines 261-301typescript

261 if (settled) return;

262 settled = true;

263 if (timer) clearTimeout(timer);

264 reject(err instanceof Error ? err : new Error(String(err)));

265 });

266 server.listen

src/commands/login.tsView file

Lines 62-102typescript

62 * 3) browser open → Connect /authorize

63 * 4) callback ?code= → POST Connect /token (code + verifier) → access_token

64 * 5) POST worker /auth/sso (access_token + label) → athsra Bearer token