@chimerai/cli@1.2.171: Clean npm security report (Allow)

Loading npm security reports…

@chimerai/cli@1.2.171: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged

dist/commands/add.jsView file

Lines 1654-1694javascript

1654 'prompts:read', 'prompts:write',

1655 'api:keys',

1656 ].join(','),

1657 },

1658 {

1659 name: 'user',

1660 displayName: 'User',

1661 maxModelTier: 'STANDARD',

1662 permissions: ['chat:use', 'chat:history', 'models:select', 'rag:use', 'prompts:read', 'profile:read'].join(','),

1663 },

1664 {

1665 name: 'readonly',

1666 displayName: 'Read Only',

1667 maxModelTier: 'FREE',

1668 permissions: 'chat:use',

1669 },

1670];

1671

1672async function main() {

1673 const email = 'admin@example.com';

1674 const password = 'admin123';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/add.jsView on unpkg · L1674

1675

1676 const existing = await prisma.user.findUnique({ where: { email } });

1677 let adminUser = existing;

1678 if (!existing) {

1679 const hashed = await hash(password, 12);

1680 adminUser = await prisma.user.create({

1681 data: { name: 'Admin', email, password: hashed },

1682 });

1683 console.log(\`✅ Demo user created: \${email} / \${password}\`);

1684 } else {

1685 console.log(\`✅ User \${email} already exists — skipping.\`);

1686 }

1687

1688 // Seed default RBAC roles (only if admin-dashboard is installed — Role model must exist)

1689 try {

1690 for (const roleData of DEFAULT_ROLES) {

1691 await (prisma as any).role.upsert({

1692 where: { name: roleData.name },

1693 update: {

1694 displayName: roleData.displayName,

Lines 2232-2272javascript

2232 if (!pkg.prisma?.seed) {

2233 pkg.prisma = pkg.prisma ?? {};

2234 pkg.prisma.seed = 'npx tsx prisma/seed.ts';

2235 await fs_extra_1.default.writeJson(pkgPath, pkg, { spaces: 2 });

2236 spinner.text =

dist/templates/ai-service-tools.jsView file

Lines 463-503javascript

463 "any": any, "all": all, "isinstance": isinstance, "type": type,

464 "repr": repr, "hex": hex, "oct": oct, "bin": bin,

465 "ord": ord, "chr": chr, "format"

dist/commands/dev.jsView file

Lines 1-35javascript

1"use strict";

2/**

3 * Dev Command - PHASE 3.3

4 * Orchestrates complete development environment setup

5 * Starts Docker, installs dependencies, runs migrations, then starts dev server

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/scanner.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * Project Scanner - PHASE 3.1

4 * Analyzes existing Next.js projects to detect configuration, frameworks, and installed components

5 * Used by `add` and `dev` commands to make intelligent decisions

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @chimerai/cli@1.2.169 matchedIdentity = npm:QGNoaW1lcmFpL2NsaQ:1.2.169 similarity = 0.878 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/commands/add.jsView file

2252// Add import and call at the end of the main() function L2253: const patchedSeed = seedContent.replace(/main\s*\n\s*\.catch/, `main()\n .then(async () => {\n // Auto-added by chimerai add model-providers\n const { execSync } = requi... L2254: if (patchedSeed !== seedContent) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/add.jsView on unpkg · L2252

1674patternName = generic_password severity = medium line = 1674 matchedText = const pa...23';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/add.jsView on unpkg · L1674

dist/templates/ai-service-tools.jsView file

483start = time.perf_counter() L484: exec(byte_code, env) L485: elapsed_ms = int((time.perf_counter() - start) * 1000)

High

Child Process

Package source references child process execution.

dist/templates/ai-service-tools.jsView on unpkg · L483

dist/commands/dev.jsView file

15const fs_extra_1 = __importDefault(require("fs-extra")); L16: const execa_1 = require("execa"); L17: const scanner_js_1 = require("../scanner.js");

High

Shell

Package source references shell execution.

dist/commands/dev.jsView on unpkg · L15

dist/scanner.jsView file

11exports.scanProject = scanProject; L12: const path_1 = __importDefault(require("path")); L13: const fs_extra_1 = __importDefault(require("fs-extra"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scanner.jsView on unpkg · L11

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged

dist/commands/add.jsView file

Lines 1654-1694javascript

1654 'prompts:read', 'prompts:write',

1655 'api:keys',

1656 ].join(','),

1657 },

1658 {

1659 name: 'user',

1660 displayName: 'User',

1661 maxModelTier: 'STANDARD',

1662 permissions: ['chat:use', 'chat:history', 'models:select', 'rag:use', 'prompts:read', 'profile:read'].join(','),

1663 },

1664 {

1665 name: 'readonly',

1666 displayName: 'Read Only',

1667 maxModelTier: 'FREE',

1668 permissions: 'chat:use',

1669 },

1670];

1671

1672async function main() {

1673 const email = 'admin@example.com';

1674 const password = 'admin123';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/add.jsView on unpkg · L1674

1675

1676 const existing = await prisma.user.findUnique({ where: { email } });

1677 let adminUser = existing;

1678 if (!existing) {

1679 const hashed = await hash(password, 12);

1680 adminUser = await prisma.user.create({

1681 data: { name: 'Admin', email, password: hashed },

1682 });

1683 console.log(\`✅ Demo user created: \${email} / \${password}\`);

1684 } else {

1685 console.log(\`✅ User \${email} already exists — skipping.\`);

1686 }

1687

1688 // Seed default RBAC roles (only if admin-dashboard is installed — Role model must exist)

1689 try {

1690 for (const roleData of DEFAULT_ROLES) {

1691 await (prisma as any).role.upsert({

1692 where: { name: roleData.name },

1693 update: {

1694 displayName: roleData.displayName,

Lines 2232-2272javascript

2232 if (!pkg.prisma?.seed) {

2233 pkg.prisma = pkg.prisma ?? {};

2234 pkg.prisma.seed = 'npx tsx prisma/seed.ts';

2235 await fs_extra_1.default.writeJson(pkgPath, pkg, { spaces: 2 });

2236 spinner.text =

dist/templates/ai-service-tools.jsView file

Lines 463-503javascript

463 "any": any, "all": all, "isinstance": isinstance, "type": type,

464 "repr": repr, "hex": hex, "oct": oct, "bin": bin,

465 "ord": ord, "chr": chr, "format"

dist/commands/dev.jsView file

Lines 1-35javascript

1"use strict";

2/**

3 * Dev Command - PHASE 3.3

4 * Orchestrates complete development environment setup

5 * Starts Docker, installs dependencies, runs migrations, then starts dev server

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/scanner.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * Project Scanner - PHASE 3.1

4 * Analyzes existing Next.js projects to detect configuration, frameworks, and installed components

5 * Used by `add` and `dev` commands to make intelligent decisions

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

@chimerai/cli@1.2.171

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code