registry / @culvii/cli / 0.1.1
@culvii/cli@0.1.1
Culvii CLI
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged command execution evaluates project resource files for Culvii’s dev and deploy workflows, and parsed definitions are sent with the selected workspace context. The inspected credential requests use the configured Culvii authentication and API services; no malicious behavior was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user invokes a CLI command such as login or dev; project evaluation and sync are part of the dev command.
Impact
Project resource definitions are transmitted to the user’s Culvii workspace as required for sync; no unrelated credential collection or data collector was identified.
Mechanism
The CLI evaluates project `.culvii.ts` resources and sends parsed definitions through the Culvii dev sync connection. Authentication tokens are used with the configured Culvii services.
AI rationale
The flagged command execution evaluates project resource files for Culvii’s dev and deploy workflows, and parsed definitions are sent with the selected workspace context. The inspected credential requests use the configured Culvii authentication and API services; no malicious behavior was established.
Evidence
~/.culvii configuration and token storage (paths are constructed by the CLI)
Network endpoints3
${q.cognitoDomain}/oauth2/token${q.apiBaseUrl}/auth/meconsole.culvii.com/
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes `dist/index.js` as the CLI and declares no install lifecycle scripts.
- The dev evaluator runs project `.culvii.ts` files and captures output containing Culvii resource definitions for processing.
- When the dev sync runs, it sends the parsed resource definition with its type, slug, and workspace ID over the sync connection.
- Login stores tokens for Culvii authentication, and token refresh sends the refresh token to the configured Cognito OAuth endpoint.
Evidence against
- The inspected credential flow is for Culvii login and its configured authentication service.
- The inspected project-data transfer occurs as part of the CLI’s dev sync behavior; no unrelated collector or hidden install-time transfer was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinified
Source & flagged code
6 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @culvii/cli@0.0.7
matchedIdentity = npm:QGN1bHZpaS9jbGk:0.0.7
similarity = 0.633
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg1#!/usr/bin/env node
L2: import {a as a$5}from'./chunk-RS5GDTRN.js';import {a as a$4,b as b$1,c as c$1}from'./chunk-KZG5CFSB.js';import {d,f,a as a$1,e,j,n,c,q,r,s,o,k,l}from'./chunk-P2LUQRIM.js';import {a...
L3: `);}async function l(){let p=await Be(e),w;try{w=await Ye(p);}catch(g){s(x,`Evaluation failed, skipping this sync cycle: ${g.message}`,"error");return}let y$1=new Map,h=new Set,C=n...
High
1#!/usr/bin/env node
L2: import {a as a$5}from'./chunk-RS5GDTRN.js';import {a as a$4,b as b$1,c as c$1}from'./chunk-KZG5CFSB.js';import {d,f,a as a$1,e,j,n,c,q,r,s,o,k,l}from'./chunk-P2LUQRIM.js';import {a...
L3: `);}async function l(){let p=await Be(e),w;try{w=await Ye(p);}catch(g){s(x,`Evaluation failed, skipping this sync cycle: ${g.message}`,"error");return}let y$1=new Map,h=new Set,C=n...
Findings
1 Critical4 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/lib/evaluator.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @culvii/cli@0.1.1.
See all versions of @culvii/cli for other recorded verdicts.
- Review the evidence and your use of @culvii/cli@0.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.