registry / @contrail/cli / 3.5.6
@contrail/cli@3.5.6
⚠ Under reviewVibeIQ's Contrail Platform CLI.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe inspected manifest has no install lifecycle hook, and the flagged feature-flag commands perform explicit authenticated CLI operations. The selected @contrail/loader dependency is used at runtime but its implementation could not be inspected, so this package cannot be cleared as clean.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the load-local CLI command may load @contrail/loader.
Impact
That command's behavior remains unresolved.
Mechanism
The command imports a declared dependency whose implementation was unavailable in the snapshot.
AI rationale
The inspected manifest has no install lifecycle hook, and the flagged feature-flag commands perform explicit authenticated CLI operations. The selected @contrail/loader dependency is used at runtime but its implementation could not be inspected, so this package cannot be cleared as clean.
Evidence
package.jsondist/commands/load-local/index.js
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @contrail/loader as a runtime dependency, and load-local imports it; that implementation was unavailable for source review.
- The manifest scripts contain build and packaging tasks but no install lifecycle hook.
- Feature-flag import and export run as explicit CLI commands and call the authenticated API for those operations.
Evidence against
- The protobuf.js flagged file is a bundled module loader that initializes protobuf.js modules; the inspected excerpt shows no hidden payload execution.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
12 flaggeddist/helpers/app/metadata-extractor.jsView file
5const os = tslib_1.__importStar(require("os"));
L6: const child_process_1 = require("child_process");
L7: const fs_1 = tslib_1.__importDefault(require("fs"));
High
Child Process
Package source references child process execution.
dist/helpers/app/metadata-extractor.jsView on unpkg · L5node_modules/@opentelemetry/otlp-transformer/node_modules/@opentelemetry/resources/build/esm/detectors/platform/node/machine-id/execAsync.jsView file
17import * as util from 'util';
L18: export const execAsync = util.promisify(child_process.exec);
L19: //# sourceMappingURL=execAsync.js.map
High
Shell
Package source references shell execution.
node_modules/@opentelemetry/otlp-transformer/node_modules/@opentelemetry/resources/build/esm/detectors/platform/node/machine-id/execAsync.jsFindings
7 High7 Medium6 Low
HighChild Processdist/helpers/app/metadata-extractor.js
HighShellnode_modules/@opentelemetry/otlp-transformer/node_modules/@opentelemetry/resources/build/esm/detectors/platform/node/machine-id/execAsync.js
HighObfuscated Payload Loadernode_modules/protobufjs/dist/protobuf.js
HighRuntime Package Installdist/helpers/app/app-deployer.js
HighShips High Entropy Blobnode_modules/amazon-cognito-identity-js/dist/amazon-cognito-identity.min.js.gz
HighPayload In Excluded Dirnode_modules/thread-stream/test/dir with spaces/test-package.zip
HighSemantic Analysis Limiteddist/commands/feature-flags/import.js#virtual:normalized:round1
MediumDynamic Requiredist/logger.js
MediumUnsafe Vm Contextnode_modules/pino/benchmarks/utils/wrap-log-level.js
Affected versions and remediation
This report applies to @contrail/cli@3.5.6.
See all versions of @contrail/cli for other recorded verdicts.
- Review the evidence and your use of @contrail/cli@3.5.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.