Loading npm security reports…

@chimerai/cli@1.2.167: Suspicious npm security report (Warn) | LPM Firewall

registry / @chimerai/cli / 1.2.167

@chimerai/cli@1.2.167

CLI wizard for ChimerAI starter kit — scaffold auth, RBAC, AI chat, billing and more into any Next.js project

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 49 file(s), 1.55 MB of source, external domains: api.airtable.com, api.anthropic.com, api.groq.com, api.openai.com, api.stripe.com, app.example.com, chimerai-activate-worker.chimerai.workers.dev, chimerai.dev, dashboard.stripe.com, en.wikipedia.org, example.com, generativelanguage.googleapis.com, github.com, hooks.zapier.com, my-blog.com, my-shop.com, n8n.example.com, news.ycombinator.com, nextjs.org, openapi.vercel.sh, python.org, sentry.io, upload.wikimedia.org, upstash.com, webhook.site, www.googleapis.com, www.prisma.io, www.w3.org, your-app.com, your-cdn.com, your-resource.openai.azure.com, your-site.com, yourdomain.com

Source & flagged code

5 flagged

dist/commands/add.jsView file

Lines 1646-1686javascript

1646 'prompts:read', 'prompts:write',

1647 'api:keys',

1648 ].join(','),

1649 },

1650 {

1651 name: 'user',

1652 displayName: 'User',

1653 maxModelTier: 'STANDARD',

1654 permissions: ['chat:use', 'chat:history', 'models:select', 'rag:use', 'prompts:read', 'profile:read'].join(','),

1655 },

1656 {

1657 name: 'readonly',

1658 displayName: 'Read Only',

1659 maxModelTier: 'FREE',

1660 permissions: 'chat:use',

1661 },

1662];

1663

1664async function main() {

1665 const email = 'admin@example.com';

1666 const password = 'admin123';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/add.jsView on unpkg · L1666

1667

1668 const existing = await prisma.user.findUnique({ where: { email } });

1669 let adminUser = existing;

1670 if (!existing) {

1671 const hashed = await hash(password, 12);

1672 adminUser = await prisma.user.create({

1673 data: { name: 'Admin', email, password: hashed },

1674 });

1675 console.log(\`✅ Demo user created: \${email} / \${password}\`);

1676 } else {

1677 console.log(\`✅ User \${email} already exists — skipping.\`);

1678 }

1679

1680 // Seed default RBAC roles (only if admin-dashboard is installed — Role model must exist)

1681 try {

1682 for (const roleData of DEFAULT_ROLES) {

1683 await (prisma as any).role.upsert({

1684 where: { name: roleData.name },

1685 update: {

1686 displayName: roleData.displayName,

Lines 2224-2264javascript

2224 if (!pkg.prisma?.seed) {

2225 pkg.prisma = pkg.prisma ?? {};

2226 pkg.prisma.seed = 'npx tsx prisma/seed.ts';

2227 await fs_extra_1.default.writeJson(pkgPath, pkg, { spaces: 2 });

2228 spinner.text =

dist/templates/ai-service-tools.jsView file

Lines 463-503javascript

463 "any": any, "all": all, "isinstance": isinstance, "type": type,

464 "repr": repr, "hex": hex, "oct": oct, "bin": bin,

465 "ord": ord, "chr": chr, "format"

dist/commands/dev.jsView file

Lines 1-35javascript

1"use strict";

2/**

3 * Dev Command - PHASE 3.3

4 * Orchestrates complete development environment setup

5 * Starts Docker, installs dependencies, runs migrations, then starts dev server

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/scanner.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * Project Scanner - PHASE 3.1

4 * Analyzes existing Next.js projects to detect configuration, frameworks, and installed components

5 * Used by `add` and `dev` commands to make intelligent decisions

6 */

7var __importDefault = (this && this.__importDefault) ||

Source & flagged code

5 flagged

dist/commands/add.jsView file

Lines 1646-1686javascript

1646 'prompts:read', 'prompts:write',

1647 'api:keys',

1648 ].join(','),

1649 },

1650 {

1651 name: 'user',

1652 displayName: 'User',

1653 maxModelTier: 'STANDARD',

1654 permissions: ['chat:use', 'chat:history', 'models:select', 'rag:use', 'prompts:read', 'profile:read'].join(','),

1655 },

1656 {

1657 name: 'readonly',

1658 displayName: 'Read Only',

1659 maxModelTier: 'FREE',

1660 permissions: 'chat:use',

1661 },

1662];

1663

1664async function main() {

1665 const email = 'admin@example.com';

1666 const password = 'admin123';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/add.jsView on unpkg · L1666

1667

1668 const existing = await prisma.user.findUnique({ where: { email } });

1669 let adminUser = existing;

1670 if (!existing) {

1671 const hashed = await hash(password, 12);

1672 adminUser = await prisma.user.create({

1673 data: { name: 'Admin', email, password: hashed },

1674 });

1675 console.log(\`✅ Demo user created: \${email} / \${password}\`);

1676 } else {

1677 console.log(\`✅ User \${email} already exists — skipping.\`);

1678 }

1679

1680 // Seed default RBAC roles (only if admin-dashboard is installed — Role model must exist)

1681 try {

1682 for (const roleData of DEFAULT_ROLES) {

1683 await (prisma as any).role.upsert({

1684 where: { name: roleData.name },

1685 update: {

1686 displayName: roleData.displayName,

Lines 2224-2264javascript

2224 if (!pkg.prisma?.seed) {

2225 pkg.prisma = pkg.prisma ?? {};

2226 pkg.prisma.seed = 'npx tsx prisma/seed.ts';

2227 await fs_extra_1.default.writeJson(pkgPath, pkg, { spaces: 2 });

2228 spinner.text =

dist/templates/ai-service-tools.jsView file

Lines 463-503javascript

463 "any": any, "all": all, "isinstance": isinstance, "type": type,

464 "repr": repr, "hex": hex, "oct": oct, "bin": bin,

465 "ord": ord, "chr": chr, "format"

dist/commands/dev.jsView file

Lines 1-35javascript

1"use strict";

2/**

3 * Dev Command - PHASE 3.3

4 * Orchestrates complete development environment setup

5 * Starts Docker, installs dependencies, runs migrations, then starts dev server

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/scanner.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * Project Scanner - PHASE 3.1

4 * Analyzes existing Next.js projects to detect configuration, frameworks, and installed components

5 * Used by `add` and `dev` commands to make intelligent decisions

6 */

7var __importDefault = (this && this.__importDefault) ||

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code