registry / @docusign/cli / 1.2.0-rc
@docusign/cli@1.2.0-rc
The Docusign CLI simplifies the implementation of Docusign Agreement Manager. With this CLI, you can bulk configure Agreement Manager with custom fields and types, map fields to types, provide AI training sets for custom extractions, programmatically test
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe published package is a DocuSign Agreement Manager CLI whose bin is dist/index.mjs and whose scripts do not install hooks that mutate the machine or an agent config. Assistant-file copies and the global npm update are user-invoked and stay on this package’s own templates and registry name.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No automatic install or import trigger. Agent files are written when a user runs scaffold or add-ai-skills, and the updater runs when the user runs the update command.
Impact
No unconsented credential theft, remote payload, persistence, or foreign agent-control write was established.
Mechanism
The CLI copies first-party assistant templates with overwrite disabled and, on update, installs @docusign/cli@latest from registry.npmjs.org. OAuth tokens stay with DocuSign account endpoints.
AI rationale
The published package is a DocuSign Agreement Manager CLI whose bin is dist/index.mjs and whose scripts do not install hooks that mutate the machine or an agent config. Assistant-file copies and the global npm update are user-invoked and stay on this package’s own templates and registry name.
Decision evidence
public snapshotAI called this Clean at 78.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hook. The published bin entries point at dist/index.mjs, and the only lifecycle-like script is prepare running husky.
- copyAiSkillTemplates copies the bundled ai-skills directory into a caller-supplied path with overwrite false, and is reached from the scaffold and add-ai-skills commands.
- The MicroLines employment-letter file is an Office document identified by the ZIP marker [Content_Types].xml, not an executable payload.
- The update command shells out to npm install -g @docusign/cli@latest against the npm registry only after the user runs that command.
Evidence against
- Scaffold copies Claude, Cursor, Gemini, and GitHub instruction files unless the user passes --no-ai-skills, and the Claude template allows Bash(ds *).
- Login telemetry registers a hashed user id and account id with a hardcoded Mixpanel project token.
- prepare runs husky, which matters for a git checkout of this package and not for a normal registry install.
Behavioral surface
ChildProcessCrypto
Source & flagged code
13 flaggeddist/index.mjsView file
6const __filename = fileURLToPath(import.meta.url);
L7: const __dirname = dirname(__filename);
L8: var Of=Object.defineProperty;var xL=Object.getOwnPropertyDescriptor;var vL=Object.getOwnPropertyNames;var _L=Object.prototype.hasOwnProperty;var a=(t,e)=>Of(t,"name",{value:e,confi...
L9: `)}displayWidth(e){return jE(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map(r=>r==="[options]"?this.styleOptionText(r):r==="[command]"?this.styleSubcommandT...
...
L19: (Did you mean one of ${i.join(", ")}?)`:i.length===1?`
L20: (Did you mean ${i[0]}?)`:""}a(IL,"suggestSimilar");PE.suggestSimilar=IL});var UE=g(nx=>{var kL=j("node:events").EventEmitter,Qg=j("node:child_process"),Xi=j("node:path"),jf=j("node...
L21: - specify the name in Command constructor or using .name()`);return
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.mjsView on unpkg · L66Trigger-reachable chain: manifest.main -> dist/index.mjs
L6: const __filename = fileURLToPath(import.meta.url);
L7: const __dirname = dirname(__filename);
L8: var Of=Object.defineProperty;var xL=Object.getOwnPropertyDescriptor;var vL=Object.getOwnPropertyNames;var _L=Object.prototype.hasOwnProperty;var a=(t,e)=>Of(t,"name",{value:e,confi...
L9: `)}displayWidth(e){return jE(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map(r=>r==="[options]"?this.styleOptionText(r):r==="[command]"?this.styleSubcommandT...
...
L19: (Did you mean one of ${i.join(", ")}?)`:i.length===1?`
L20: (Did you mean ${i[0]}?)`:""}a(IL,"suggestSimilar");PE.suggestSimilar=IL});var UE=g(nx=>{var kL=j("node:events").EventEmitter,Qg=j("node:child_process"),Xi=j("node:path"),jf=j("node...
L21: - specify t
Findings
2 Critical9 High4 Medium7 Low
CriticalCredential Exfiltrationdist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighObfuscated Payload Loaderdist/index.mjs
HighTrigger Reachable Credential Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
HighShips High Entropy Blobdist/templates/agreement-manager/files/test/MicroLines Employment Offer Letter.docx
HighPayload In Excluded Dir
Affected versions and remediation
This report applies to @docusign/cli@1.2.0-rc.
See all versions of @docusign/cli for other recorded verdicts.
- Review the evidence and your use of @docusign/cli@1.2.0-rc before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.