Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 11 finding(s) warrant review before installing.

View on npm All versions

registry / @cachly-dev/cli / 0.4.1

@cachly-dev/cli@0.4.1

Terminal CLI for Cachly — manage AI Brain instances, live cache ops, benchmarks, cost estimates, and Redis migrations. Works with free tier.

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 100 KB of source, external domains: api.cachly.dev, auth.cachly.dev, cachly.dev, github.com, registry.npmjs.org

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/auth.jsView file

14import { withCapability } from '../capabilities.js'; L15: const AUTH_BASE = 'https://auth.cachly.[redacted]-connect'; L16: const CLIENT_ID = 'cachly-cli'; ... L19: async function openBrowser(url) { L20: const { execSync } = await import('node:child_process'); L21: const platform = process.platform; L22: try { ... L36: headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, L37: body: `client_id=${CLIENT_ID}&scope=openid`, L38: }); ... L40: throw new Error(`Device flow init failed: HTTP ${initRes.status}`); L41: const init = await initRes.json();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/auth.jsView on unpkg · L14

Findings

2 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitydist/commands/auth.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Maintainersheinrichneb

Version0.4.1

PublishedJul 19, 2026

LicenseApache-2.0

Dependencies5

Integrityverified

Package size44.0 KB

Files67

Keywordscachlycacheredisclivalkeysemantic-cacheai-memoryai-brain

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsbin → cachly

Runtimenode >=18.0.0

Artifact

LPM CLI

206 KB · 67 files1 signature(s)

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

@cachly-dev/cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

3 flagged

package.jsonView file

Lines 1-32json

1{

2 "name": "@cachly-dev/cli",

3 "version": "0.4.1",

4 "description": "Terminal CLI for Cachly — manage AI Brain instances, live cache ops, benchmarks, cost estimates, and Redis migrations. Works with free tier.",

5 "type": "module",

6 "bin": {

7 "cachly": "./dist/index.js"

8 },

9 "main": "./dist/index.js",

10 "scripts": {

11 "build": "tsc && chmod +x dist/index.js",

12 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 "dev": "tsc --watch",

14 "test": "vitest run",

15 "typecheck": "tsc --noEmit",

16 "prepublishOnly": "npm run build"

17 },

18 "keywords": [

19 "cachly",

20 "cache",

21 "redis",

22 "cli",

23 "valkey",

24 "semantic-cache",

25 "ai-memory",

26 "ai-brain",

27 "llm",

28 "mcp",

29 "instance-management",

30 "redis-cli",

31 "developer-tools",

32 "benchmark",

dist/commands/auth.jsView file

Lines 1-34javascript

1/**

2 * cachly auth – Login, Logout, Status

3 *

4 * cachly auth login → OAuth 2.0 Device Authorization Flow (zero-friction)

5 * cachly auth logout → Löscht gespeicherten Token

6 * cachly auth status → Zeigt aktuellen Auth-Status

7 * cachly auth token → Gibt aktuellen JWT aus (für Scripts)

8 */

9import { Command } from 'commander';

10import ora from 'ora';

11import chalk from 'chalk';

12import { readConfig, writeConfig, API_URL } from '../config.js';

13import { ok, err, handleError } from '../output.js';

14import { withCapability } from '../capabilities.js';

15const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';

16const CLIENT_ID = 'cachly-cli';

17const POLL_INTERVAL_MS = 5_000;

18const MAX_WAIT_MS = 10 * 60 * 1000; // 10 minutes

19async function openBrowser(url) {

20 const { execSync } = await import('node:child_process');

21 const platform = process.platform;

22 try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/auth.jsView on unpkg · L14

23 if (platform === 'darwin')

24 execSync(`open "${url}"`, { stdio: 'ignore' });

25 else if (platform === 'win32')

26 execSync(`start "" "${url}"`, { stdio: 'ignore' });

27 else

28 execSync(`xdg-open "${url}"`, { stdio: 'ignore' });

29 }

30 catch { /* ignore – user can open manually */ }

31}

32async function deviceFlow() {

33 // 1. Start device flow

34 const initRes = await fetch(`${AUTH_BASE}/auth/device`, {