@datarails-ai/dr-cli@1.6.109: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@datarails-ai/dr-cli@1.6.109: AI-agent control-surface risk | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

7L8: // package.json L9: var package_default = { ... L257: async function cleanupV1IfPresent(opts = {}) { L258: const home = opts.home ?? os.homedir(); L259: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L260: const drDir = path.join(home, ".dr"); ... L370: function credentialsFilePath() { L371: const override = process.env[CREDENTIALS_FILE_ENV]; L372: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L383: try { L384: parsed2 = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L257: async function cleanupV1IfPresent(opts = {}) { L258: const home = opts.home ?? os.homedir(); L259: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L260: const drDir = path.join(home, ".dr"); ... L370: function credentialsFilePath() { L371: const override = process.env[CREDENTIALS_FILE_ENV]; L372: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L383: try { L384: parsed2 = JSON.parse(raw);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L7

•matchType = previous_version_dangerous_delta matchedPackage = @datarails-ai/dr-cli@1.6.85 matchedIdentity = npm:QGRhdGFyYWlscy1haS9kci1jbGk:1.6.85 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

2902import { randomInt } from "crypto"; L2903: import { spawn } from "child_process"; L2904: import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2902

3466} L3467: function escPowerShellSingle(s) { L3468: return s.replace(/'/g, "''");

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L3466

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `keychain set ${service}:${account}: the Windows Credential Manager is full (Windows error code 8), so this credential could not be saved. Remove saved logins you no longer need wi... import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises"; // A user-bound API key, exchanged for `access` on demand. A file may hold // DR-52657: the NAME of an environment variable holding the API key, for await writeFile(tmp, body, { mode: 384 }); * its text can be quoting the `Authorization` header it blocked. throw new Error("api-key exchange: the stored API key is empty"); "api-key exchange: dr only accepts an API key of p

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

7L8: // package.json L9: var package_default = { ... L257: async function cleanupV1IfPresent(opts = {}) { L258: const home = opts.home ?? os.homedir(); L259: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L260: const drDir = path.join(home, ".dr"); ... L370: function credentialsFilePath() { L371: const override = process.env[CREDENTIALS_FILE_ENV]; L372: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L383: try { L384: parsed2 = JSON.parse(raw);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L7

7Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L257: async function cleanupV1IfPresent(opts = {}) { L258: const home = opts.home ?? os.homedir(); L259: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L260: const drDir = path.join(home, ".dr"); ... L370: function credentialsFilePath() { L371: const override = process.env[CREDENTIALS_FILE_ENV]; L372: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L383: try { L384: parsed2 = JSON.parse(raw);

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.jsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

scripts/postinstall.mjsView file

49Cross-file remote execution chain: scripts/postinstall.mjs spawns dist/cli.js; helper contains network access plus dynamic code execution. L49: L50: import { spawnSync } from 'node:child_process'; L51: import { existsSync } from 'node:fs'; ... L63: L64: const target = homedir(); L65: const result = spawnSync('node', [cli, 'skill', 'install', target], { stdio: 'inherit' }); ... L67: if (result.status !== 0) { L68: process.stderr.write( L69: `(dr-cli postinstall: skill copy returned ${result.status} — run \`dr skill install ~\` to retry)\n`,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.mjsView on unpkg · L49

dist/skills/validate-workato-migration/scripts/compare_files.pyView file

•path = dist/skills/validate-workato-migration/scripts/compare_files.py kind = build_helper sizeBytes = 9438 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/validate-workato-migration/scripts/compare_files.pyView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 39-61json

39 "msw": "^2.3.0",

40 "prettier": "^3.3.0",

41 "tsup": "^8.1.0",

42 "tsx": "^4.16.0",

43 "typescript": "^5.5.0",

44 "vitest": "^2.0.0"

45 },

46 "scripts": {

47 "dev": "tsx src/cli.ts",

48 "build": "tsup",

49 "gen:scopes": "tsx scripts/gen-scopes-map.mts",

50 "check:scopes": "tsx scripts/gen-scopes-map.mts --check",

51 "gen:endpoints": "tsx scripts/gen-endpoints.mts",

52 "check:endpoints": "tsx scripts/gen-endpoints.mts --check",

53 "typecheck": "tsc -p tsconfig.build.json --noEmit",

54 "test": "vitest run",

55 "test:watch": "vitest",

56 "lint": "eslint",

57 "format": "prettier --write .",

58 "format:check": "prettier --check .",

59 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 }

61}

dist/cli.jsView file

7L8: // package.json L9: var package_default = { ... L257: async function cleanupV1IfPresent(opts = {}) { L258: const home = opts.home ?? os.homedir(); L259: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L260: const drDir = path.join(home, ".dr"); ... L370: function credentialsFilePath() { L371: const override = process.env[CREDENTIALS_FILE_ENV]; L372: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L383: try { L384: parsed2 = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L257: async function cleanupV1IfPresent(opts = {}) { L258: const home = opts.home ?? os.homedir(); L259: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L260: const drDir = path.join(home, ".dr"); ... L370: function credentialsFilePath() { L371: const override = process.env[CREDENTIALS_FILE_ENV]; L372: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L383: try { L384: parsed2 = JSON.parse(raw);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L7

•matchType = previous_version_dangerous_delta matchedPackage = @datarails-ai/dr-cli@1.6.85 matchedIdentity = npm:QGRhdGFyYWlscy1haS9kci1jbGk:1.6.85 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

scripts/postinstall.mjsView file

Lines 29-69javascript

29// - dist/cli.js missing (dev install before `pnpm build`) — skip silently

30// - skill copy returns non-zero — log a warning and let the install

31// succeed. The user can rerun `dr skill install ~` later.

32//

33// We intentionally do NOT use `process.exit(non-zero)` from this hook,

34// because npm aborts the entire install on a non-zero postinstall exit.

35// Failing to copy a skill shouldn't break the operator's install.

36//

37// Cleaning up removed skills: when a future release drops a skill that

38// previous releases shipped, add an explicit `rm` call here for the

dist/skills/validate-workato-migration/scripts/compare_files.pyView file

•path = dist/skills/validate-workato-migration/scripts/compare_files.py kind = build_helper sizeBytes = 9438 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/validate-workato-migration/scripts/compare_files.pyView on unpkg