registry / @enrichlayer/el-linear / 1.41.0

@enrichlayer/el-linear@1.41.0

⚠ Under review

A pragmatic CLI for Linear.app — deterministic team/label/member resolution, structured issue validation, configurable term enforcement, and a GraphQL escape hatch.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 136 file(s), 876 KB of source, external domains: api.linear.app, en.wikipedia.org, example.com, github.com, linear.app

Source & flagged code

4 flagged

dist/utils/output.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { resolveActiveProfile } from "../config/paths.js";

High

Child Process

Package source references child process execution.

dist/utils/output.jsView on unpkg · L1

3import { dispatch as dispatchSummary, drainSummaryFieldWarnings, formatLine, inferKindFromPayload, } from "./formatters/summary.js";

4import { logger } from "./logger.js";

5import { sanitizeForLog } from "./sanitize-for-log.js";

6const warningBuffer = [];

7let rawMode = false;

8let quietMode = false;

9let jqFilter = null;

10let fieldsFilter = null;

11let outputFormat = "json";

12export function setRawMode(enabled) {

13 rawMode = enabled;

14}

15/**

16 * `--quiet` (write commands only): collapse the success payload to a single

17 * confirmation line via `formatLine`, bypassing both the JSON envelope and

18 * the summary block. Set in main.ts's preAction when the flag is present.

19 */

20export function setQuietMode(enabled) {

21 quietMode = enabled;

dist/commands/init/oauth.jsView file

Lines 1-39javascript

1/**

2 * Wizard step for OAuth 2.0 (PKCE flow) authorization.

3 *

4 * Flow:

5 * 1. Read optional local/team OAuth app defaults, if present.

6 * 2. Otherwise present a "what is this?" intro pointing the user at

7 * Linear's OAuth app registration page, then prompt for `client_id`,

8 * optional `client_secret`, port, scopes.

9 * 3. Generate PKCE verifier + state, build the authorize URL.

10 * 4. Try to open the system browser; fall back to printing the URL.

11 * 5. Spin a localhost listener (or fall back to pasted-code prompt) to

dist/commands/gdoc.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { extractDocId, parseGoogleDoc } from "../utils/gdoc-parser.js";

3import { handleAsyncCommand } from "../utils/output.js";

4export function setupGdocCommands(program) {

5 program

6 .command

dist/commands/issue-id.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @enrichlayer/el-linear@1.34.1 matchedIdentity = npm:QGVucmljaGxheWVyL2VsLWxpbmVhcg:1.34.1 similarity = 0.746 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/issue-id.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/utils/output.jsView file

1import { execFileSync } from "node:child_process"; L2: import { resolveActiveProfile } from "../config/paths.js";

High

Child Process

Package source references child process execution.

dist/utils/output.jsView on unpkg · L1

dist/commands/init/oauth.jsView file

19*/ L20: import { spawn } from "node:child_process"; L21: import { checkbox, input, password, select } from "@inquirer/prompts"; ... L30: const DEFAULT_PORT = 8765; L31: const REGISTRATION_URL = "https://linear.[redacted]"; L32: const VIEWER_QUERY = /* GraphQL */ ` ... L63: let args; L64: if (process.platform === "darwin") { L65: cmd = "open";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/init/oauth.jsView on unpkg · L19

dist/commands/gdoc.jsView file

1import { execFileSync } from "node:child_process"; L2: import { extractDocId, parseGoogleDoc } from "../utils/gdoc-parser.js"; ... L7: .description("Convert a Google Doc to Markdown (requires gws CLI).") L8: .addHelpText("after", "\nAccepts a Google Doc ID or full URL.\nRequires gws CLI: npm install -g @googleworkspace/cli") L9: .action(handleAsyncCommand(async (docIdOrUrl) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/gdoc.jsView on unpkg · L1

dist/commands/issue-id.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/issue-id.jsView on unpkg

Findings

1 Critical4 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands/issue-id.js

HighChild Processdist/utils/output.js

HighShell

HighSandbox Evasion Gated Capabilitydist/commands/init/oauth.js

HighRuntime Package Installdist/commands/gdoc.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/utils/output.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { resolveActiveProfile } from "../config/paths.js";

High

Child Process

Package source references child process execution.

dist/utils/output.jsView on unpkg · L1

3import { dispatch as dispatchSummary, drainSummaryFieldWarnings, formatLine, inferKindFromPayload, } from "./formatters/summary.js";

4import { logger } from "./logger.js";

5import { sanitizeForLog } from "./sanitize-for-log.js";

6const warningBuffer = [];

7let rawMode = false;

8let quietMode = false;

9let jqFilter = null;

10let fieldsFilter = null;

11let outputFormat = "json";

12export function setRawMode(enabled) {

13 rawMode = enabled;

14}

15/**

16 * `--quiet` (write commands only): collapse the success payload to a single

17 * confirmation line via `formatLine`, bypassing both the JSON envelope and

18 * the summary block. Set in main.ts's preAction when the flag is present.

19 */

20export function setQuietMode(enabled) {

21 quietMode = enabled;

dist/commands/init/oauth.jsView file

Lines 1-39javascript

1/**

2 * Wizard step for OAuth 2.0 (PKCE flow) authorization.

3 *

4 * Flow:

5 * 1. Read optional local/team OAuth app defaults, if present.

6 * 2. Otherwise present a "what is this?" intro pointing the user at

7 * Linear's OAuth app registration page, then prompt for `client_id`,

8 * optional `client_secret`, port, scopes.

9 * 3. Generate PKCE verifier + state, build the authorize URL.

10 * 4. Try to open the system browser; fall back to printing the URL.

11 * 5. Spin a localhost listener (or fall back to pasted-code prompt) to

dist/commands/gdoc.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { extractDocId, parseGoogleDoc } from "../utils/gdoc-parser.js";

3import { handleAsyncCommand } from "../utils/output.js";

4export function setupGdocCommands(program) {

5 program

6 .command

dist/commands/issue-id.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/issue-id.jsView on unpkg