Loading npm security reports…

@dashnex/cli@0.5.81: Clean npm security report (Allow) | LPM Firewall

registry / @dashnex/cli / 0.5.81

@dashnex/cli@0.5.81

Command-line interface for DashNex framework

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The executable performs DashNex CLI actions only after an explicit user invocation; credential storage and `.gitignore` mutation occur in the explicit login flow.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `dashnex` commands such as login, dev, install, deploy, or tail.

Impact

Expected project-local configuration, package-manager/dev subprocesses, and service API interactions; no unconsented install-time action found.

Mechanism

Explicit CLI command dispatch, local command-module discovery, and authenticated DashNex API calls.

Rationale

Static inspection shows an ordinary service CLI with user-invoked network, credential, filesystem, and subprocess operations. Scanner signals arise from expected CLI functionality and do not establish a malicious chain.

Evidence

package.jsonbin/dashnexdist/cli.jsdist/commands/index.jsdist/src/commands/login.d.tsdist/src/commands/install.d.ts.dashnex/settings.json.gitignoredashnex.json

Network endpoints6

api.dashnex.comapi.qa.dashnex.comapi.business.dashnex.comapi.business.qa.dashnex.com3atfynmu2w.us-east-1.awsapprunner.comrkwbzvhcwh.us-east-1.awsapprunner.com

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/cli.js` dynamically imports command modules from the active project and installed DashNex modules.
`dist/commands/index.js` runs package-manager/dev subprocesses only through explicit CLI commands.
`dist/commands/index.js` stores login tokens in a project-local `.dashnex/settings.json` file.

Evidence against

`package.json` has no preinstall, install, postinstall, prepare, or uninstall lifecycle hook.
`bin/dashnex` only checks Node.js version then imports `dist/cli.js` when the user runs the binary.
Network requests target DashNex API/business hosts and are tied to login, deployment, secrets, status, and tail commands.
Debug logging redacts token, password, and auth_code fields in `dist/commands/index.js`.
No eval, Function, VM execution, native loader, or remote-code download/execution was found.
No AI-agent configuration, VCS hook, broad persistence, or destructive filesystem behavior was found.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2import{n as o,t as n}from"./chunks/errors-7HJEDWYU.js";import{Command as s}from"commander";import e from"chalk";import t from"fs-extra";import i from"path";import{fileURLToPath as c,pathToFileURL as a}from"url";import{execSync as r}from"child_process";import d from"dotenv";var l=new s,m=i.dirname(c(import.meta.url)),{version:p,description:f}=JSON.parse(t.readFileSync(i.resolve(m,"..","package.json"),"utf8"));l.name("dashnex").description(f).version(p).option("--ci","Disable spinner and interactive prompts (CI mode)").arguments("[command...]").action(o=>{if(o&&o.length>0){const n=o[0];if(!l.com ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L1

Long lines were clipped for display.

dist/commands/index.jsView file

Lines 1-1javascript

1import{n as e,t}from"../chunks/errors-7HJEDWYU.js";import s from"chalk";import o from"fs-extra";import n from"path";import{fileURLToPath as r}from"url";

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

1#!/usr/bin/env node L2: import{n as o,t as n}from"./chunks/errors-7HJEDWYU.js";import{Command as s}from"commander";import e from"chalk";import t from"fs-extra";import i from"path";import{fileURLToPath as ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L1

dist/commands/index.jsView file

1import{n as e,t}from"../chunks/errors-7HJEDWYU.js";import s from"chalk";import o from"fs-extra";import n from"path";import{fileURLToPath as r}from"url";import{spawn as a}from"child...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/index.jsView on unpkg · L1

1import{n as e,t}from"../chunks/errors-7HJEDWYU.js";import s from"chalk";import o from"fs-extra";import n from"path";import{fileURLToPath as r}from"url";import{spawn as a}from"child...

Findings

2 High3 Medium4 Low

HighSame File Env Network Executiondist/commands/index.js

HighCommand Output Exfiltrationdist/commands/index.js

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License