@elnora-ai/cli@2.5.2: Suspicious npm security report (Warn)

Loading npm security reports…

@elnora-ai/cli@2.5.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

Lines 37-70json

37 "dependencies": {

38 "@commander-js/extra-typings": "^14.0.0",

39 "@modelcontextprotocol/sdk": "^1.29.0",

40 "commander": "^14.0.3",

41 "express": "^5.2.1",

42 "express-rate-limit": "^8.5.2",

43 "picocolors": "^1.1.1",

44 "zod": "^4.4.3"

45 },

46 "devDependencies": {

47 "@biomejs/biome": "2.5.3",

48 "@types/express": "^5.0.6",

49 "@types/node": "^25.9.3",

50 "@yao-pkg/pkg": "^6.21.0",

51 "esbuild": "^0.28.1",

52 "tsx": "^4.23.1",

53 "typescript": "^6.0.3",

54 "vitest": "^4.1.10"

55 },

56 "scripts": {

57 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "build": "node scripts/build-npm.mjs",

59 "build:binary": "node scripts/build.mjs --pkg",

60 "dev": "tsx src/cli.ts",

61 "audit:mcp-parity": "tsx scripts/audit-mcp-parity.ts",

62 "docs:reference": "tsx scripts/gen-docs-reference.ts",

63 "test": "vitest run",

64 "test:watch": "vitest",

65 "lint": "biome check src/ __tests__/",

66 "lint:fix": "biome check --write src/ __tests__/",

67 "format": "biome format --write src/ __tests__/",

68 "typecheck": "tsc --noEmit"

69 }

70}

dist/cli.jsView file

Lines 12-52javascript

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

2208// src/commands/open.ts L2209: import { exec } from "node:child_process"; L2210: var URLS = {

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2208

1351} L1352: const result = await cmd.execute(parsed, ctx); L1353: if (result != null) {

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1351

32"use strict"; L33: VERSION = true ? "2.5.2" : process.env.npm[redacted] ?? "0.0.0-dev"; L34: PRODUCTION_BASE_URL = "https://platform.elnora.ai/api/v1"; L35: BASE_URL = process.env.ELNORA_API_URL ?? PRODUCTION_BASE_URL; ... L187: } L188: function getExitCode(err) { L189: for (const [ErrorClass, code] of EXIT_CODES) { ... L378: mkdirSync(dir, { recursive: true }); L379: if (process.platform !== "win32") { L380: try { ... L492: init_errors(); L493: CONFIG_DIR = join(homedir(), ".elnora");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L32

32Detached bundled service listener: dist/cli.js launches a Node helper and exposes a broad-bound HTTP listener. L32: "use strict"; L33: VERSION = true ? "2.5.2" : process.env.npm[redacted] ?? "0.0.0-dev"; L34: PRODUCTION_BASE_URL = "https://platform.elnora.ai/api/v1"; L35: BASE_URL = process.env.ELNORA_API_URL ?? PRODUCTION_BASE_URL; ... L187: } L188: function getExitCode(err) { L189: for (const [ErrorClass, code] of EXIT_CODES) { ... L378: mkdirSync(dir, { recursive: true }); L379: if (process.platform !== "win32") { L380: try { ... L492: init_errors(); L493: CONFIG_DIR = join(homedir(), ".elnora");

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/cli.jsView on unpkg · L32

Lines 2188-2228javascript

2188 return value;

2189}

2190function addMcpCommands(program2, registry2) {

2191 const mcp = program2.command("mcp").description("MCP server management");

2192 mcp.command("serve").description("Start MCP server exposing all CLI commands as tools").option("--http", "HTTP transport (default, for deployment)").option("--stdio", "stdio transport (for local MCP clients)").option("--port <port>", "HTTP port", process.env.PORT ?? "3000").option

2193 if (opts.stdio) {

2194 const { startStdioServer: startStdioServer2 } = await Promise.resolve().then(() => (init_stdio_server(), stdio_server_exports));

2195 await startStdioServer2(registry2);

2196 } else {

2197 const { startHttpServer: startHttpServer2 } = await Promise.resolve().then(() => (init_http_server(), http_server_exports));

2198 await startHttpServer2(registry2, {

2199 port: Number.parseInt(opts.port, 10),

2200 host: opts.host,

2201 tokenValidationUrl: requireEnv("ELNORA_TOKEN_VALIDATION_URL"),

2202 mcpServiceKey: requireEnv("ELNORA_MCP_SERVICE_KEY")

2203 });

2204 }

2205 });

2206}

2207

2208// src/commands/open.ts

2209import { exec } from "node:child_process";

2210var URLS = {

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2208

2211 "": "https://platform.elnora.ai",

2212 platform: "https://platform.elnora.ai",

2213 docs: "https://docs.elnora.ai",

2214 keys: "https://platform.elnora.ai/settings/api-keys",

2215 billing: "https://platform.elnora.ai/settings/billing",

2216 github: "https://github.com/Elnora-AI/elnora-cli"

2217};

2218function openUrl(url) {

2219 const cmd = process.platform === "darwin" ? `open "${url}"` : process.platform === "win32" ? `start "" "${url}"` : `xdg-open "${url}"`;

2220 exec(cmd, (err) => {

2221 if (err) {

2222 console.error(`Failed to open browser: ${err.message}`);

2223 console.log(url);

2224 }

2225 });

2226}

2227function addOpenCommand(program2) {

2228 program2.command("open").argument("[page]", "Page to open: platform, docs, keys, billing, github").description("Open Elnora platform in the browser").action((page) => {

@elnora-ai/cli@2.5.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code