registry / @enrichlayer/el-linear / 1.41.0

@enrichlayer/el-linear@1.41.0

⚠ Under review

A pragmatic CLI for Linear.app — deterministic team/label/member resolution, structured issue validation, configurable term enforcement, and a GraphQL escape hatch.

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 136 file(s), 876 KB of source, external domains: api.linear.app, en.wikipedia.org, example.com, github.com, linear.app

Source & flagged code

4 flagged

dist/utils/output.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { resolveActiveProfile } from "../config/paths.js";

High

Child Process

Package source references child process execution.

dist/utils/output.jsView on unpkg · L1

3import { dispatch as dispatchSummary, drainSummaryFieldWarnings, formatLine, inferKindFromPayload, } from "./formatters/summary.js";

Source & flagged code

4 flagged · loading source

dist/utils/output.jsView file

1import { execFileSync } from "node:child_process"; L2: import { resolveActiveProfile } from "../config/paths.js";

High

Child Process

Package source references child process execution.

dist/utils/output.jsView on unpkg · L1

dist/commands/init/oauth.jsView file

19*/ L20: import { spawn } from "node:child_process"; L21: import { checkbox, input, password, select } from "@inquirer/prompts"; ... L30: const DEFAULT_PORT = 8765; L31: const REGISTRATION_URL = "https://linear.[redacted]"; L32: const VIEWER_QUERY = /* GraphQL */ ` ... L63: let args; L64: if (process.platform === "darwin") { L65: cmd = "open";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/init/oauth.jsView on unpkg · L19

dist/commands/gdoc.jsView file

1import { execFileSync } from "node:child_process"; L2: import { extractDocId, parseGoogleDoc } from "../utils/gdoc-parser.js"; ... L7: .description("Convert a Google Doc to Markdown (requires gws CLI).") L8: .addHelpText("after", "\nAccepts a Google Doc ID or full URL.\nRequires gws CLI: npm install -g @googleworkspace/cli") L9: .action(handleAsyncCommand(async (docIdOrUrl) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/gdoc.jsView on unpkg · L1

dist/commands/issue-id.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @enrichlayer/el-linear@1.34.1 matchedIdentity = npm:QGVucmljaGxheWVyL2VsLWxpbmVhcg:1.34.1 similarity = 0.746 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/issue-id.jsView on unpkg

Findings

1 Critical4 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands/issue-id.js

HighChild Processdist/utils/output.js

HighShell

HighSandbox Evasion Gated Capabilitydist/commands/init/oauth.js

HighRuntime Package Installdist/commands/gdoc.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/commands/init/oauth.jsView file

Lines 1-39javascript

1/**

2 * Wizard step for OAuth 2.0 (PKCE flow) authorization.

3 *

4 * Flow:

5 * 1. Read optional local/team OAuth app defaults, if present.

6 * 2. Otherwise present a "what is this?" intro pointing the user at

7 * Linear's OAuth app registration page, then prompt for `client_id`,

8 * optional `client_secret`, port, scopes.

9 * 3. Generate PKCE verifier + state, build the authorize URL.

10 * 4. Try to open the system browser; fall back to printing the URL.

11 * 5. Spin a localhost listener (or fall back to pasted-code prompt) to

12 * receive the redirect.

13 * 6. Exchange code for tokens.

14 * 7. Validate by calling `viewer { ... }` with the new bearer token.

15 * 8. Persist `oauth.json` to the active profile.

16 *

17 * Idempotent: if a fresh `oauth.json` already exists, offer keep / re-auth /

18 * revoke before doing anything else.

19 */

20import { spawn } from "node:child_process";

21import { checkbox, input, password, select } from "@inquirer/prompts";

22import { readTeamOAuthConfig } from "../../auth/oauth-app-config.js";

23import { DEFAULT_CALLBACK_PATH, runLocalhostCallback, } from "../../auth/oauth-callback.js";

24import { ALL_SCOPES, buildAuthorizeUrl, DEFAULT_SCOPES, generatePkce, generateState, SCOPE_DESCRIPTIONS, validateActorScopes, validateScopes, } from "../../auth/oauth-client.js";

25import { promptForPastedCode } from "../../auth/oauth-headless.js";

26import { clearOAuthState, OAUTH_STATE_VERSION, readOAuthState, writeOAuthState, } from "../../auth/oauth-storage.js";

27import { exchangeCodeForTokens, revokeToken, } from "../../auth/oauth-token.js";

28import { GraphQLService } from "../../utils/graphql-service.js";

29import { sanitizeForLog } from "./token.js";

30const DEFAULT_PORT = 8765;

31const REGISTRATION_URL = "https://linear.app/settings/api/applications/new";

32const VIEWER_QUERY = /* GraphQL */ `

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/init/oauth.jsView on unpkg · L19

33 query {

34 viewer {

35 id

36 name

37 email

38 displayName

39 organization {

dist/commands/gdoc.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { extractDocId, parseGoogleDoc } from "../utils/gdoc-parser.js";

3import { handleAsyncCommand } from "../utils/output.js";

4export function setupGdocCommands(program) {

5 program

6 .command("gdoc <docIdOrUrl>")

7 .description("Convert a Google Doc to Markdown (requires gws CLI).")

8 .addHelpText("after", "\nAccepts a Google Doc ID or full URL.\nRequires gws CLI: npm install -g @googleworkspace/cli")

9 .action(handleAsyncCommand(async (docIdOrUrl) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/gdoc.jsView on unpkg · L1

10 const docId = extractDocId(docIdOrUrl);

11 let stdout;

12 try {

13 stdout = execFileSync("gws", [

14 "docs",

15 "documents",

16 "get",

17 "--params",

18 JSON.stringify({ documentId: docId }),

19 ], {

20 encoding: "utf-8",

21 timeout: 30_000,