registry / @chimerai/cli / 1.2.173

@chimerai/cli@1.2.173

CLI wizard for ChimerAI starter kit — scaffold auth, RBAC, AI chat, billing and more into any Next.js project

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No install-time malicious behavior is established. An explicit AI-tools scaffold can generate a restricted Python code executor, creating a downstream dangerous capability if deployed with untrusted code input.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `chimerai add ai-tools` and deploys the generated service.

Impact

Potential downstream remote-code-execution exposure in the generated application; no confirmed compromise of the package consumer during installation.

Mechanism

Generated Python code compilation and execution via `exec`.

Rationale

Source inspection does not support a malicious publish block, but the optional generated code executor is a real dangerous capability with incomplete execution controls. Downgrade to warn rather than marking clean.

Evidence

package.jsondist/cli.jsdist/commands/add.jsdist/commands/create.jsdist/templates/ai-service-tools.jsdist/license.jsdist/utils/provider-db.js~/.chimerai/license.json

Network endpoints3

chimerai-activate-worker.chimerai.workers.dev/activateapi.openai.com/v1/modelsapi.anthropic.com/v1/messages

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/templates/ai-service-tools.js` generates a Python `CodeInterpreterTool` that compiles and executes supplied code.
The generated executor's `timeout` parameter is not enforced around `exec(byte_code, env)`.
`dist/commands/add.js` can write the AI-tools template into a target project after an explicit add command.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` lifecycle hook.
`dist/cli.js` registers actions behind explicit `chimerai` subcommands; importing `dist/index.js` only exports modules.
`dist/commands/create.js` runs its generated installer only when the user supplies `--install`.
Network use is package-aligned: license activation uses the ChimerAI worker, while provider validation calls user-selected provider APIs.
No source evidence of credential harvesting, exfiltration, hidden persistence, remote payload loading, or AI-agent configuration mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 49 file(s), 1.57 MB of source, external domains: api.airtable.com, api.anthropic.com, api.groq.com, api.openai.com, api.stripe.com, app.example.com, chimerai-activate-worker.chimerai.workers.dev, chimerai.dev, dashboard.stripe.com, demo.chimerai.dev, en.wikipedia.org, example.com, generativelanguage.googleapis.com, github.com, hooks.zapier.com, my-blog.com, my-shop.com, n8n.example.com, news.ycombinator.com, nextjs.org, openapi.vercel.sh, python.org, sentry.io, upload.wikimedia.org, upstash.com, webhook.site, www.googleapis.com, www.prisma.io, www.w3.org, your-app.com, your-cdn.com, your-resource.openai.azure.com, your-site.com, yourdomain.com

Source & flagged code

6 flagged

dist/commands/add.jsView file

Lines 1655-1695javascript

1655 'prompts:read', 'prompts:write',

1656 'api:keys',

1657 ].join(','),

1658 },

1659 {

1660 name: 'user',

1661 displayName: 'User',

1662 maxModelTier: 'STANDARD',

1663 permissions: ['chat:use', 'chat:history', 'models:select', 'rag:use', 'prompts:read', 'profile:read'].join(','),

1664 },

1665 {

1666 name: 'readonly',

1667 displayName: 'Read Only',

1668 maxModelTier: 'FREE',

1669 permissions: 'chat:use',

1670 },

1671];

1672

1673async function main() {

1674 const email = 'admin@example.com';

1675 const password = 'admin123';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/add.jsView on unpkg · L1675

1676

1677 const existing = await prisma.user.findUnique({ where: { email } });

1678 let adminUser = existing;

1679 if (!existing) {

1680 const hashed = await hash(password, 12);

1681 adminUser = await prisma.user.create({

1682 data: { name: 'Admin', email, password: hashed },

1683 });

1684 console.log(\`✅ Demo user created: \${email} / \${password}\`);

1685 } else {

1686 console.log(\`✅ User \${email} already exists — skipping.\`);

1687 }

1688

1689 // Seed default RBAC roles (only if admin-dashboard is installed — Role model must exist)

1690 try {

1691 for (const roleData of DEFAULT_ROLES) {

1692 await (prisma as any).role.upsert({

1693 where: { name: roleData.name },

1694 update: {

1695 displayName: roleData.displayName,

Lines 2234-2274javascript

2234 if (!pkg.prisma?.seed) {

2235 pkg.prisma = pkg.prisma ?? {};

2236 pkg.prisma.seed = 'npx tsx prisma/seed.ts';

2237 await fs_extra_1.default.writeJson(pkgPath, pkg, { spaces: 2 });

2238 spinner.text =

•matchType = previous_version_dangerous_delta matchedPackage = @chimerai/cli@1.2.172 matchedIdentity = npm:QGNoaW1lcmFpL2NsaQ:1.2.172 similarity = 0.959 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/add.jsView on unpkg

dist/templates/ai-service-tools.jsView file

Lines 463-503javascript

463 "any": any, "all": all, "isinstance": isinstance, "type": type,

464 "repr": repr, "hex": hex, "oct": oct, "bin": bin,

465 "ord": ord, "chr": chr, "format"

dist/commands/dev.jsView file

Lines 1-35javascript

1"use strict";

2/**

3 * Dev Command - PHASE 3.3

4 * Orchestrates complete development environment setup

5 * Starts Docker, installs dependencies, runs migrations, then starts dev server

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/scanner.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * Project Scanner - PHASE 3.1

4 * Analyzes existing Next.js projects to detect configuration, frameworks, and installed components

5 * Used by `add` and `dev` commands to make intelligent decisions

6 */

7var __importDefault = (this && this.__importDefault) ||

Source & flagged code

6 flagged · loading source

dist/commands/add.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/add.jsView on unpkg

2254// Add import and call at the end of the main() function L2255: const patchedSeed = seedContent.replace(/main\s*\n\s*\.catch/, `main()\n .then(async () => {\n // Auto-added by chimerai add model-providers\n const { execSync } = requi... L2256: if (patchedSeed !== seedContent) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/add.jsView on unpkg · L2254

1675patternName = generic_password severity = medium line = 1675 matchedText = const pa...23';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/add.jsView on unpkg · L1675

dist/templates/ai-service-tools.jsView file

483start = time.perf_counter() L484: exec(byte_code, env) L485: elapsed_ms = int((time.perf_counter() - start) * 1000)

High

Child Process

Package source references child process execution.

dist/templates/ai-service-tools.jsView on unpkg · L483

dist/commands/dev.jsView file

15const fs_extra_1 = __importDefault(require("fs-extra")); L16: const execa_1 = require("execa"); L17: const scanner_js_1 = require("../scanner.js");

High

Shell

Package source references shell execution.

dist/commands/dev.jsView on unpkg · L15

dist/scanner.jsView file

11exports.scanProject = scanProject; L12: const path_1 = __importDefault(require("path")); L13: const fs_extra_1 = __importDefault(require("fs-extra"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scanner.jsView on unpkg · L11

Findings

1 Critical3 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands/add.js

HighChild Processdist/templates/ai-service-tools.js

HighShelldist/commands/dev.js

HighRuntime Package Installdist/commands/add.js

MediumSecret Patterndist/commands/add.js

MediumDynamic Requiredist/scanner.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/commands/add.jsView file

Lines 1655-1695javascript

1655 'prompts:read', 'prompts:write',

1656 'api:keys',

1657 ].join(','),

1658 },

1659 {

1660 name: 'user',

1661 displayName: 'User',

1662 maxModelTier: 'STANDARD',

1663 permissions: ['chat:use', 'chat:history', 'models:select', 'rag:use', 'prompts:read', 'profile:read'].join(','),

1664 },

1665 {

1666 name: 'readonly',

1667 displayName: 'Read Only',

1668 maxModelTier: 'FREE',

1669 permissions: 'chat:use',

1670 },

1671];

1672

1673async function main() {

1674 const email = 'admin@example.com';

1675 const password = 'admin123';

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/add.jsView on unpkg · L1675

1676

1677 const existing = await prisma.user.findUnique({ where: { email } });

1678 let adminUser = existing;

1679 if (!existing) {

1680 const hashed = await hash(password, 12);

1681 adminUser = await prisma.user.create({

1682 data: { name: 'Admin', email, password: hashed },

1683 });

1684 console.log(\`✅ Demo user created: \${email} / \${password}\`);

1685 } else {

1686 console.log(\`✅ User \${email} already exists — skipping.\`);

1687 }

1688

1689 // Seed default RBAC roles (only if admin-dashboard is installed — Role model must exist)

1690 try {

1691 for (const roleData of DEFAULT_ROLES) {

1692 await (prisma as any).role.upsert({

1693 where: { name: roleData.name },

1694 update: {

1695 displayName: roleData.displayName,

Lines 2234-2274javascript

2234 if (!pkg.prisma?.seed) {

2235 pkg.prisma = pkg.prisma ?? {};

2236 pkg.prisma.seed = 'npx tsx prisma/seed.ts';

2237 await fs_extra_1.default.writeJson(pkgPath, pkg, { spaces: 2 });

2238 spinner.text =

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/add.jsView on unpkg

dist/templates/ai-service-tools.jsView file

Lines 463-503javascript

463 "any": any, "all": all, "isinstance": isinstance, "type": type,

464 "repr": repr, "hex": hex, "oct": oct, "bin": bin,

465 "ord": ord, "chr": chr, "format"

dist/commands/dev.jsView file

Lines 1-35javascript

1"use strict";

2/**

3 * Dev Command - PHASE 3.3

4 * Orchestrates complete development environment setup

5 * Starts Docker, installs dependencies, runs migrations, then starts dev server

6 */

7var __importDefault = (this && this.__importDefault) ||

dist/scanner.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * Project Scanner - PHASE 3.1

4 * Analyzes existing Next.js projects to detect configuration, frameworks, and installed components

5 * Used by `add` and `dev` commands to make intelligent decisions

6 */

7var __importDefault = (this && this.__importDefault) ||