@docusign/cli@1.3.1-rc
The Docusign CLI simplifies the implementation of Docusign Agreement Manager. With this CLI, you can bulk configure Agreement Manager with custom fields and types, map fields to types, provide AI training sets for custom extractions, programmatically test
AI Security Review
scanned 22h ago · by lpm-firewall-aiThe bundle contains runtime Mixpanel telemetry that includes account identifiers and project names, with no disclosure found in the package README. This warrants a warning for identifying telemetry; the flagged credential redirection and hidden execution behavior were not established in the inspected source.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
CLI startup identifies an existing user and account; ingestion commands send project details with telemetry events.
Impact
The analytics service may learn the account identity and project name. No credential theft or unrelated collection was established.
Mechanism
Telemetry registers account ID and account name, identifies a hashed user ID, and includes projectName in ingestion event properties.
AI rationale
The bundle contains runtime Mixpanel telemetry that includes account identifiers and project names, with no disclosure found in the package README. This warrants a warning for identifying telemetry; the flagged credential redirection and hidden execution behavior were not established in the inspected source.
Evidence
dist/index.mjs
Network endpoints1
api.mixpanel.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime telemetry sends the current project name and document-ingestion counts with command events.
- At startup, the CLI identifies a hashed user ID and registers account ID and account name with telemetry.
- The bundled feature-flag client uses api.mixpanel.com.
Evidence against
- The manifest describes a Docusign CLI and points its main and bin entries to dist/index.mjs; its prepare hook only runs husky.
- The login flow uses Docusign OAuth PKCE and stores credentials in the CLI config.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
13 flaggeddist/index.mjsView file
6const __filename = fileURLToPath(import.meta.url);
L7: const __dirname = dirname(__filename);
L8: var Zp=Object.defineProperty;var rV=Object.getOwnPropertyDescriptor;var nV=Object.getOwnPropertyNames;var iV=Object.prototype.hasOwnProperty;var a=(t,e)=>Zp(t,"name",{value:e,confi...
L9: `)}displayWidth(e){return xT(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map(r=>r==="[options]"?this.styleOptionText(r):r==="[command]"?this.styleSubcommandT...
...
L19: (Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L20: (Did you mean ${n[0]}?)`:""}a(hV,"suggestSimilar");yT.suggestSimilar=hV});var DT=g(qx=>{var gV=k("node:events").EventEmitter,Rx=k("node:child_process"),po=k("node:path"),Jp=k("node...
L21: - specify the name in Command constructor or using .name()`);return
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.mjsView on unpkg · L66Trigger-reachable chain: manifest.main -> dist/index.mjs
L6: const __filename = fileURLToPath(import.meta.url);
L7: const __dirname = dirname(__filename);
L8: var Zp=Object.defineProperty;var rV=Object.getOwnPropertyDescriptor;var nV=Object.getOwnPropertyNames;var iV=Object.prototype.hasOwnProperty;var a=(t,e)=>Zp(t,"name",{value:e,confi...
L9: `)}displayWidth(e){return xT(e).length}styleTitle(e){return e}styleUsage(e){return e.split(" ").map(r=>r==="[options]"?this.styleOptionText(r):r==="[command]"?this.styleSubcommandT...
...
L19: (Did you mean one of ${n.join(", ")}?)`:n.length===1?`
L20: (Did you mean ${n[0]}?)`:""}a(hV,"suggestSimilar");yT.suggestSimilar=hV});var DT=g(qx=>{var gV=k("node:events").EventEmitter,Rx=k("node:child_process"),po=k("node:path"),Jp=k("node...
L21: - specify t
Findings
2 Critical9 High4 Medium7 Low
CriticalCredential Exfiltrationdist/index.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.mjs
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
HighObfuscated Payload Loaderdist/index.mjs
HighTrigger Reachable Credential Exfiltrationdist/index.mjs
HighTrigger Reachable Command Output Exfiltrationdist/index.mjs
HighShips High Entropy Blobdist/templates/agreement-manager/files/test/MicroLines Employment Offer Letter.docx
HighPayload In Excluded Dir
Affected versions and remediation
This report applies to @docusign/cli@1.3.1-rc.
See all versions of @docusign/cli for other recorded verdicts.
- Review the evidence and your use of @docusign/cli@1.3.1-rc before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.