registry / @ciderpress/cli / 1.0.0-rc.8

@ciderpress/cli@1.0.0-rc.8

CLI for building and serving ciderpress documentation sites

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Dangerous primitives are user-invoked CLI behavior for documentation generation, local dev serving, git inspection, and scoped cleanup.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs ciderpress CLI commands such as setup, dev, build, serve, sync, clean, or diff.

Impact

Creates or removes project documentation artifacts under .ciderpress and may write ciderpress.config.ts/.gitignore on explicit setup.

Mechanism

documentation-site CLI file generation and local server operations

Rationale

Static inspection of the bundled source map and package files shows a normal Ciderpress documentation CLI; scanner hits map to bundled dependencies or explicit commands. There is no install-time mutation, exfiltration, persistence, or remote code execution behavior.

Evidence

package.jsondist/index.mjsdist/index.mjs.mapREADME.mdtemplates/openapi-overview.liquidtemplates/openapi-operation.liquidciderpress.config.ts.gitignore.ciderpress/<tmpdir>/ciderpress/error-*.log

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall hooks; only bin maps ciderpress to dist/index.mjs.
dist/index.mjs.map shows sourceContent for a docs-site CLI with setup/dev/build/serve/sync/clean commands.
setup writes ciderpress.config.ts, .ciderpress/.gitignore, and generated assets only after explicit user command.
clean/sync removals are scoped to derived .ciderpress cache/content/dist or manifest-tracked output paths.
child_process use is package-aligned: git remote/status/diff and browser open helpers, no shell eval or remote payload execution.
No credential exfiltration or package-owned network endpoint found; URLs are docs, local dev server, or OpenAPI examples.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 402 KB of source, external domains: api.example.com, github.com, www.w3.org

Source & flagged code

5 flagged

dist/index.mjsView file

Lines 1-47javascript

1#!/usr/bin/env node

3import{createRequire as e}from"node:module";import t,{basename as n,dirname as r,extname as i,isAbsolute as a,join as o,resolve as s,sep as c}from"node:path";import l,{existsSync as u,lstatSync as d,mkdirSync as f,promises as p,readFileSync as m,readdirSync as h,realpathSync as g,statSync as _,unlinkSync as v,watch as y,writeFileSync as b}from"node:fs";import{homedir as ee,platform as x,tmpdir as S}from"node:os";import*as C from"@clack/prompts";import{log as w,updateSettings as T}from"@clack/prompts";import{notStrictEqual as te,strictEqual as ne}from"assert";import{basename as re,dirname as E, ...

4`)},note(e,t,r){C.note(e,t,kr(n,r))},box(e,t,n){C.box(e,t,kr(r,n))},outro(e){C.outro(e,n)},raw(e){t.write(`${e}\n`)},step(e,t){C.log.step(e,kr(n,t))},success(e,t){C.log.success(e,kr(n,t))},warn(e,t){C.log.warn(e,kr(n,t))},stream:Nr()})}function jr(e){return e!==void 0&&e.output!==void 0?e.output:process.stderr}function Mr(e,t){return t===void 0?e:{...e,...t}}function Nr(){return Object.freeze({async info(e){await C.stream.info(e)},async success(e){await C.stream.success(e)},async error(e){await C.stream.error(e)},async warn(e){await C.stream.warn(e)},async step(e){await C.stream.step(e)},async ...

5`)}\n`}function Gr(e){let t=Or(e?.defaults);return{async confirm(e){return Kr(await C.confirm({...t,...e}))},async multiselect(e){return Kr(await C.multiselect({...t,...e}))},async password(e){return Kr(await C.password({...t,...e}))},async select(e){return Kr(await C.select({...t,...e}))},async text(e){return Kr(await C.text({...t,...e}))},async autocomplete(e){return Kr(await C.autocomplete({...t,...e}))},async autocompleteMultiselect(e){return Kr(await C.autocompleteMultiselect({...t,...e}))},async groupMultiselect(e){return Kr(await C.groupMultiselect({...t,...e}))},async selectKey(e){retu ...

6`).map(e=>e.split(` `)),n=0;return t.forEach(e=>{e.length>1&&hi.stringWidth(e[0])>n&&(n=Math.min(Math.floor(this.width*.5),hi.stringWidth(e[0])))}),t.forEach(e=>{this.div(...e.map((t,r)=>({text:t.trim(),padding:this.measurePadding(t),width:r===0&&e.length>1?n:void 0})))}),this.rows[this.rows.length-1]}colFromString(e){return{text:e,padding:this.measurePadding(e)}}measurePadding(e){let t=hi.stripAnsi(e);return[0,t.match(/\s*$/)[0].length,0,t.match(/^\s*/)[0].length]}toString(){let e=[];return this.rows.forEach(t=>{this.rowToString(t,e)}),e.filter(e=>!e.hidden).map(e=>e.text).join(`

7`)}rowToString(e,t){return this.rasterize(e).forEach((n,r)=>{let i=``;n.forEach((n,a)=>{let{width:o}=e[a],s=this.negatePadding(e[a]),c=n;if(s>hi.stringWidth(n)&&(c+=` `.repeat(s-hi.stringWidth(n))),e[a].align&&e[a].align!==`left`&&this.wrap){let t=li[e[a].align];c=t(c,s),hi.stringWidth(c)<s&&(c+=` `.repeat((o||0)-hi.stringWidth(c)-1))}let l=e[a].padding||[0,0,0,0];l[pi]&&(i+=` `.repeat(l[pi])),i+=ri(e[a],c,`| `),i+=c,i+=ri(e[a],c,` |`),l[di]&&(i+=` `.repeat(l[di])),r===0&&t.length>0&&(i=this.renderInline(i,t[t.length-1]))}),t.push({text:i.replace(/ +$/,``),span:e.span})}),t}renderInline(e,t){l ...

8`):e.text.split(`

9`),e.border&&(r.unshift(`.`+`-`.repeat(this.negatePadding(e)+2)+`.`),r.push(`'`+`-`.repeat(this.negatePadding(e)+2)+`'`)),e.padding&&(r.unshift(...Array(e.padding[ui]||0).fill(``)),r.push(...Array(e.padding[fi]||0).fill(``))),r.forEach((e,n)=>{t[n]||t.push([]);let r=t[n];for(let e=0;e<i;e++)r[e]===void 0&&r.push(``);r.push(e)})}),t}negatePadding(e){let t=e.width||0;return e.padding&&(t-=(e.padding[pi]||0)+(e.padding[di]||0)),e.border&&(t-=4),t}columnWidths(e){if(!this.wrap)return e.map(e=>e.width||hi.stringWidth(e.text));let t=e.length,n=this.width,r=e.map(e=>{if(e.width)return t--,n-=e.width, ...

10`,`

11`).split(`

12`).map(e=>pa(e,t,n)).join(`

13`)}var ta,na,ra,ia,aa,oa,sa,ca,la,ua,da,fa,pa,ma=I((()=>{Wi(),xi(),$i(),ta=new Set([`\x1B`,``]),na=39,ra=`\x07`,ia=`[`,aa=`]`,oa=`m`,sa=`${aa}8;;`,ca=e=>`${ta.values().next().value}${ia}${e}${oa}`,la=e=>`${ta.values().next().value}${sa}${e}${ra}`,ua=e=>e.split(` `).map(e=>Vi(e)),da=(e,t,n)=>{let r=[...t],i=!1,a=!1,o=Vi(yi(e.at(-1)));for(let[t,s]of r.entries()){let c=Vi(s);if(o+c<=n?e[e.length-1]+=s:(e.push(s),o=0),ta.has(s)&&(i=!0,a=r.slice(t+1,t+1+sa.length).join(``)===sa),i){a?s===ra&&(i=!1,a=!1):s===oa&&(i=!1);continue}o+=c,o===n&&t<r.length-1&&(e.push(``),o=0)}!o&&e.at(-1).length>0&&e.len ...

14`),l=[...c],u=0;for(let[e,t]of l.entries()){if(r+=t,ta.has(t)){let{groups:e}=RegExp(`(?:\\${ia}(?<code>\\d+)m|\\${sa}(?<uri>.*)${ra})`).exec(c.slice(u))||{groups:{}};if(e.code!==void 0){let t=Number.parseFloat(e.code);i=t===na?void 0:t}else e.uri!==void 0&&(a=e.uri.length===0?void 0:e.uri)}let n=Qi.codes.get(Number(i));l[e+1]===`

15`?(a&&(r+=la(``)),i&&n&&(r+=ca(n))):t===`

16`&&(i&&n&&(r+=ca(i)),a&&(r+=la(a))),u+=t.length}return r}}));function ha(e){return ci(e,{stringWidth:Vi,stripAnsi:yi,wrap:ea})}var ga=I((()=>{gi(),Wi(),xi(),ma()}));function _a(e,t){let n=ce(`.`,e),r;for(de(n).isDirectory()||(n=E(n));;){if(r=t(n,ue(n)),r)return ce(n,r);if(n=E(r=n),r===n)break}}var va=I((()=>{}));

17/**

18* @license

20* SPDX-License-Identifier: ISC

21*/

22function ya(e){if(e!==e.toLowerCase()&&e!==e.toUpperCase()||(e=e.toLowerCase()),e.indexOf(`-`)===-1&&e.indexOf(`_`)===-1)return e;{let t=``,n=!1,r=e.match(/^-+/);for(let i=r?r[0].length:0;i<e.length;i++){let r=e.charAt(i);n&&(n=!1,r=r.toUpperCase()),i!==0&&(r===`-`||r===`_`)?n=!0:r!==`-`&&r!==`_`&&(t+=r)}return t}}function ba(e,t){let n=e.toLowerCase();t||=`-`;let r=``;for(let i=0;i<e.length;i++){let a=n.charAt(i),o=e.charAt(i);a!==o&&i>0?r+=`${t}${n.charAt(i)}`:r+=o}return r}function xa(e){return e==null?!1:typeof e==`number`||/^0x[0-9a-f]+$/i.test(e)?!0:/^0[^.]/.test(e)?!1:/^[-]?(?:\d+(?:\.\ ...

23/**

24* @license

26* SPDX-License-Identifier: ISC

27*/

28function Ca(e){if(Array.isArray(e))return e.map(e=>typeof e==`string`?e:e+``);e=e.trim();let t=0,n=null,r=null,i=null,a=[];for(let o=

29`);w.div(`${e}\n`)}return w.toString().replace(/\s*$/,``)};function v(e,n,r){let i=0;return Array.isArray(e)||(e=Object.values(e).map(e=>[e])),e.forEach(e=>{i=Math.max(t.stringWidth(r?`${r} ${Jo(e[0])}`:Jo(e[0]))+qo(e[0]),i)}),n&&(i=Math.min(i,parseInt((n*.5).toString(),10))),i}function y(){let t=e.getDemandedOptions(),n=e.getOptions();(Object.keys(n.alias)||[]).forEach(i=>{n.alias[i].forEach(a=>{p[a]&&r.describe(i,p[a]),a in t&&e.demandOption(i,t[a]),n.boolean.includes(a)&&e.boolean(i),n.count.includes(a)&&e.count(i),n.string.includes(a)&&e.string(i),n.normalize.includes(a)&&e.normalize(i),n. ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L27

30#

31# yargs command completion script

32#

33# Installation: {{app_path}} {{completion_command}} >> ~/.bashrc

34# or {{app_path}} {{completion_command}} >> ~/.bash_profile on OSX.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.mjsView on unpkg · L2

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L2

35#

36_{{app_name}}_yargs_completions()

37{

38 local cur_word args type_list

40 cur_word="\${COMP_WORDS[COMP_CWORD]}"

41 args=("\${COMP_WORDS[@]}")

43 # ask yargs to generate completions.

44 # see https://stackoverflow.com/a/40944195/7080036 for the spaces-handling awk

45 mapfile -t type_list < <({{app_path}} --get-yargs-completions "\${args[@]}")

46 mapfile -t COMPREPLY < <(compgen -W "$( printf '%q ' "\${type_list[@]}" )" -- "\${cur_word}" |

47 awk '/ / { print "\\""$0"\\"" } /^[^ ]+$/ { print $0 }')

Long lines were clipped for display.

Lines 179-219javascript

179 {

180 title: 'Getting Started',

181 path: '/getting-started',

182 include: 'docs/*.md',

183 },

184 ],

185})

186`}async function $v(e,n){let r=t.join(e.repoRoot,`.gitignore`);if(l.existsSync(r)){let e=l.readFileSync(r,`utf8`);if(e.split(`

187`).some(e=>e.trim()===ny||e.trim()===`.

•Trigger-reachable chain: manifest.exports -> dist/index.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg

Source & flagged code

5 flagged · loading source

dist/index.mjsView file

199contains invisible/control Unicode U+FEFF (zero width no-break space) `?(s++,c=0):e?c+=e.length:c++,e&&(o+=e.length),e}let ee={default(){switch(_){case` `:case`\v`:case`\f`:case` `:case`\xA0`:case`<U+FEFF>`:case`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.mjsView on unpkg · L199

•Trigger-reachable chain: manifest.exports -> dist/index.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg

27*/ L28: function Ca(e){if(Array.isArray(e))return e.map(e=>typeof e==`string`?e:e+``);e=e.trim();let t=0,n=null,r=null,i=null,a=[];for(let o=0;o<e.length;o++){if(n=r,r=e.charAt(o),r===` `&... L29: `);w.div(`${e}\n`)}return w.toString().replace(/\s*$/,``)};function v(e,n,r){let i=0;return Array.isArray(e)||(e=Object.values(e).map(e=>[e])),e.forEach(e=>{i=Math.max(t.stringWidt...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L27

2L3: import{createRequire as e}from"node:module";import t,{basename as n,dirname as r,extname as i,isAbsolute as a,join as o,resolve as s,sep as c}from"node:path";import l,{existsSync a... L4: `)},note(e,t,r){C.note(e,t,kr(n,r))},box(e,t,n){C.box(e,t,kr(r,n))},outro(e){C.outro(e,n)},raw(e){t.write(`${e}\n`)},step(e,t){C.log.step(e,kr(n,t))},success(e,t){C.log.success(e,k... ... L27: */ L28: function Ca(e){if(Array.isArray(e))return e.map(e=>typeof e==`string`?e:e+``);e=e.trim();let t=0,n=null,r=null,i=null,a=[];for(let o=0;o<e.length;o++){if(n=r,r=e.charAt(o),r===` `&... L29: `);w.div(`${e}\n`)}return w.toString().replace(/\s*$/,``)};function v(e,n,r){let i=0;return Array.isArray(e)||(e=Object.values(e).map(e=>[e])),e.forEach(e=>{i=Math.max(t.stringWidt... ... L32: # L33: # Installation: {{app_path}} {{completion_command}} >> ~/.bashrc L34: # or {{app_path}} {{completion_command}} >> ~/.bash_profile on OSX. ... L85: `}));function $o(e,t,n,r){return new ns(e,t,n,r)}function es(e){return e.length<3}function ts(e){return e.length>3}var ns,rs=I((()=>{Ro(),fo(),Qo(),mo(),vo(),ns=class{constructor(e... L86: `)}`:``;t.fail(i(`Missing required argument: %s`,`Missing required argumen

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.mjsView on unpkg · L2

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L2

Findings

2 Critical4 Medium6 Low

CriticalTrojan Source Unicodedist/index.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs

MediumDynamic Requiredist/index.mjs

MediumEnvironment Vars

MediumInstall Persistencedist/index.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/index.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/index.mjsView file

Lines 1-47javascript

1#!/usr/bin/env node

8`):e.text.split(`

10`,`

11`).split(`

12`).map(e=>pa(e,t,n)).join(`

15`?(a&&(r+=la(``)),i&&n&&(r+=ca(n))):t===`

17/**

18* @license

20* SPDX-License-Identifier: ISC

21*/

23/**

24* @license

26* SPDX-License-Identifier: ISC

27*/

28function Ca(e){if(Array.isArray(e))return e.map(e=>typeof e==`string`?e:e+``);e=e.trim();let t=0,n=null,r=null,i=null,a=[];for(let o=

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L27

30#

31# yargs command completion script

32#

33# Installation: {{app_path}} {{completion_command}} >> ~/.bashrc

34# or {{app_path}} {{completion_command}} >> ~/.bash_profile on OSX.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.mjsView on unpkg · L2

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L2

35#

36_{{app_name}}_yargs_completions()

37{

38 local cur_word args type_list

40 cur_word="\${COMP_WORDS[COMP_CWORD]}"

41 args=("\${COMP_WORDS[@]}")

43 # ask yargs to generate completions.

44 # see https://stackoverflow.com/a/40944195/7080036 for the spaces-handling awk

45 mapfile -t type_list < <({{app_path}} --get-yargs-completions "\${args[@]}")

46 mapfile -t COMPREPLY < <(compgen -W "$( printf '%q ' "\${type_list[@]}" )" -- "\${cur_word}" |

47 awk '/ / { print "\\""$0"\\"" } /^[^ ]+$/ { print $0 }')

Long lines were clipped for display.

Lines 179-219javascript

179 {

180 title: 'Getting Started',

181 path: '/getting-started',

182 include: 'docs/*.md',

183 },

184 ],

185})

186`}async function $v(e,n){let r=t.join(e.repoRoot,`.gitignore`);if(l.existsSync(r)){let e=l.readFileSync(r,`utf8`);if(e.split(`

187`).some(e=>e.trim()===ny||e.trim()===`.

•Trigger-reachable chain: manifest.exports -> dist/index.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg