registry / @elnora-ai/cli / 2.3.0

@elnora-ai/cli@2.3.0

Elnora AI Platform CLI

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 200 KB of source, external domains: claude.ai, cli.elnora.ai, code.visualstudio.com, cursor.com, docs.elnora.ai, github.com, mcp.elnora.ai, platform.elnora.ai, registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 37-70json

37 "dependencies": {

38 "@commander-js/extra-typings": "^14.0.0",

39 "@modelcontextprotocol/sdk": "^1.29.0",

40 "commander": "^14.0.3",

41 "express": "^5.2.1",

42 "express-rate-limit": "^8.5.2",

43 "picocolors": "^1.1.1",

44 "zod": "^4.4.3"

45 },

46 "devDependencies": {

47 "@biomejs/biome": "2.5.2",

48 "@types/express": "^5.0.6",

49 "@types/node": "^25.9.3",

50 "@yao-pkg/pkg": "^6.20.0",

51 "esbuild": "^0.28.1",

52 "tsx": "^4.22.4",

53 "typescript": "^6.0.3",

54 "vitest": "^4.1.9"

55 },

56 "scripts": {

57 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "build": "node scripts/build-npm.mjs",

59 "build:binary": "node scripts/build.mjs --pkg",

60 "dev": "tsx src/cli.ts",

61 "audit:mcp-parity": "tsx scripts/audit-mcp-parity.ts",

62 "docs:reference": "tsx scripts/gen-docs-reference.ts",

63 "test": "vitest run",

64 "test:watch": "vitest",

65 "lint": "biome check src/ __tests__/",

66 "lint:fix": "biome check --write src/ __tests__/",

67 "format": "biome format --write src/ __tests__/",

68 "typecheck": "tsc --noEmit"

69 }

70}

dist/cli.jsView file

Lines 12-52javascript

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

17// src/lib/config.ts

18function

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

2187// src/commands/open.ts L2188: import { exec } from "node:child_process"; L2189: var URLS = {

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2187

1331} L1332: const result = await cmd.execute(parsed, ctx); L1333: if (result != null) {

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1331

32"use strict"; L33: VERSION = true ? "2.3.0" : process.env.npm[redacted] ?? "0.0.0-dev"; L34: PRODUCTION_BASE_URL = "https://platform.elnora.ai/api/v1"; L35: BASE_URL = process.env.ELNORA_API_URL ?? PRODUCTION_BASE_URL; ... L167: } L168: function getExitCode(err) { L169: for (const [ErrorClass, code] of EXIT_CODES) { ... L358: mkdirSync(dir, { recursive: true }); L359: if (process.platform !== "win32") { L360: try { ... L472: init_errors(); L473: CONFIG_DIR = join(homedir(), ".elnora");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L32

32Detached bundled service listener: dist/cli.js launches a Node helper and exposes a broad-bound HTTP listener. L32: "use strict"; L33: VERSION = true ? "2.3.0" : process.env.npm[redacted] ?? "0.0.0-dev"; L34: PRODUCTION_BASE_URL = "https://platform.elnora.ai/api/v1"; L35: BASE_URL = process.env.ELNORA_API_URL ?? PRODUCTION_BASE_URL; ... L167: } L168: function getExitCode(err) { L169: for (const [ErrorClass, code] of EXIT_CODES) { ... L358: mkdirSync(dir, { recursive: true }); L359: if (process.platform !== "win32") { L360: try { ... L472: init_errors(); L473: CONFIG_DIR = join(homedir(), ".elnora");

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/cli.jsView on unpkg · L32

Findings

5 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli.js

HighShelldist/cli.js

HighSandbox Evasion Gated Capabilitydist/cli.js

HighSpawned Bundled Service Listenerdist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 37-70json

37 "dependencies": {

38 "@commander-js/extra-typings": "^14.0.0",

39 "@modelcontextprotocol/sdk": "^1.29.0",

40 "commander": "^14.0.3",

41 "express": "^5.2.1",

42 "express-rate-limit": "^8.5.2",

43 "picocolors": "^1.1.1",

44 "zod": "^4.4.3"

45 },

46 "devDependencies": {

47 "@biomejs/biome": "2.5.2",

48 "@types/express": "^5.0.6",

49 "@types/node": "^25.9.3",

50 "@yao-pkg/pkg": "^6.20.0",

51 "esbuild": "^0.28.1",

52 "tsx": "^4.22.4",

53 "typescript": "^6.0.3",

54 "vitest": "^4.1.9"

55 },

56 "scripts": {

57 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "build": "node scripts/build-npm.mjs",

59 "build:binary": "node scripts/build.mjs --pkg",

60 "dev": "tsx src/cli.ts",

61 "audit:mcp-parity": "tsx scripts/audit-mcp-parity.ts",

62 "docs:reference": "tsx scripts/gen-docs-reference.ts",

63 "test": "vitest run",

64 "test:watch": "vitest",

65 "lint": "biome check src/ __tests__/",

66 "lint:fix": "biome check --write src/ __tests__/",

67 "format": "biome format --write src/ __tests__/",

68 "typecheck": "tsc --noEmit"

69 }

70}

dist/cli.jsView file

Lines 12-52javascript

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

17// src/lib/config.ts

18function

Lines 1311-1351javascript

1311 format: resolvedFormat,

1312 compact,

1313 fields: parentOpts.fields ? parentOpts.fields.split(",").map((f) => f.trim()) : void 0,

1314 quiet: Boolean(parentOpts.quiet)

1315 }

1316 };

1317 if (cmd.stdinField && input[cmd.stdinField] === "-") {

1318 if (process.stdin.isTTY) {

1319 throw new ValidationError(

1320 `'-' reads ${camelToKebab(cmd.stdinField)} from stdin, but stdin is a terminal.`,

1321 "Pipe data in, e.g.: cat file.txt | elnora ... -"

1322 );

1323 }

1324 input[cmd.stdinField] = (await readStdin()).replace(/\r?\n$/, "");

1325 }

1326 let parsed;

1327 try {

1328 parsed = cmd.inputSchema.parse(input);

1329 } catch (e) {

1330 throw toValidationError(e);

1331 }

1332 const result = await cmd.execute(parsed, ctx);

1333 if (result != null) {

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1331

1334 const isStreamed = typeof result === "object" && result.streamed === true;

1335 if (!isStreamed) {

1336 const useGeneric = Boolean(ctx.output.fields) || ctx.output.compact || ctx.output.format === "csv" || ctx.output.format === "table" || ctx.output.format === "markdown";

1337 let formatted;

1338 if (cmd.formatOutput && !useGeneric) {

1339 formatted = cmd.formatOutput(result, ctx.output.format);

1340 } else {

1341 formatted = formatOutput(result, {

1342 format: ctx.output.format,

1343 compact: ctx.output.compact,

1344 fields: ctx.output.fields

1345 });

1346 }

1347 if (formatted) {

1348 process.stdout.write(`${formatted}

1349`);

1350 }

1351 }

Lines 2167-2207javascript

2167 return value;

2168}

2169function addMcpCommands(program2, registry2) {

2170 const mcp = program2.command("mcp").description("MCP server management");

2171 mcp.command("serve").description("Start MCP server exposing all CLI commands as tools").option("--http", "HTTP transport (default, for deployment)").option("--stdio", "stdio transport (for local MCP clients)").option("--port <port>", "HTTP port", process.env.PORT ?? "3000").option("--host <host>", "HTTP bind address", process.env.HOST ?? "0.0.0.0").action(async (opts) => {

2172 if (opts.stdio) {

2173 const { startStdioServer: startStdioServer2 } = await Promise.resolve().then(() => (init_stdio_server(), stdio_server_exports));

2174 await startStdioServer2(registry2);

2175 } else {

2176 const { startHttpServer: startHttpServer2 } = await Promise.resolve().then(() => (init_http_server(), http_server_exports));

2177 await startHttpServer2(registry2, {

2178 port: Number.parseInt(opts.port, 10),

2179 host: opts.host,

2180 tokenValidationUrl: requireEnv("ELNORA_TOKEN_VALIDATION_URL"),

2181 mcpServiceKey: requireEnv("ELNORA_MCP_SERVICE_KEY")

2182 });

2183 }

2184 });

2185}

2186

2187// src/commands/open.ts

2188import { exec } from "node:child_process";

2189var URLS = {

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2187

2190 "": "https://platform.elnora.ai",

2191 platform: "https://platform.elnora.ai",

2192 docs: "https://docs.elnora.ai",

2193 keys: "https://platform.elnora.ai/settings/api-keys",

2194 billing: "https://platform.elnora.ai/settings/billing",

2195 github: "https://github.com/Elnora-AI/elnora-cli"

2196};

2197function openUrl(url) {

2198 const cmd = process.platform === "darwin" ? `open "${url}"` : process.platform === "win32" ? `start "" "${url}"` : `xdg-open "${url}"`;

2199 exec(cmd, (err) => {

2200 if (err) {

2201 console.error(`Failed to open browser: ${err.message}`);

2202 console.log(url);

2203 }

2204 });

2205}

2206function addOpenCommand(program2) {

2207 program2.command("open").argument("[page]", "Page to open: platform, docs, keys, billing, github").description("Open Elnora platform in the browser").action((page) => {