@flouviahq/cli@1.2.1
CLI de Cord: inicia sesión desde el navegador, configura tu cuenta con IA, integra tu proyecto y prueba webhooks en tu localhost.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe CLI forwards stored or supplied test keys to a configurable API destination without a destination allowlist. This is a concrete conditional credential exposure risk, so warn without blocking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs an authenticated CLI command with a custom base URL configured.
Impact
A custom host can receive the Cord test key; the source does not restrict custom hosts to Cord-controlled destinations.
Mechanism
The CLI selects the base URL from a command-line flag or environment variable, loads the key from a flag, environment variable, or config file, and sends it in an authorization header.
AI rationale
The CLI forwards stored or supplied test keys to a configurable API destination without a destination allowlist. This is a concrete conditional credential exposure risk, so warn without blocking.
Evidence
dist/cord.mjs
Network endpoints1
cordhq.app
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI accepts an operator-selected API base URL through a flag or environment variable.
- API requests send a stored or caller-supplied Cord key as a bearer token to that base URL.
- Login saves the supplied key for subsequent requests.
Evidence against
- The manifest exposes a CLI entrypoint and has only a prepublish build hook; it has no install-time lifecycle hook.
- The default API host is cordhq.app, and the key is checked to be a test key before use.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
7 flaggeddist/cord.mjsView file
89import { styleText } from "node:util";
L90: import { stdout, stdin } from "node:process";
L91: import * as l from "node:readline";
...
L426: function wrapAnsi(string, columns, options) {
L427: return String(string).normalize().split(CRLF_OR_LF).map((line) => exec(line, columns, options)).join("\n");
L428: }
...
L503: }
L504: var R = globalThis.process.platform.startsWith("win");
L505: var CANCEL_SYMBOL = /* @__PURE__ */ Symbol("clack:cancel");
...
L528: if (isActionKey([c2, a3, p], "cancel")) {
L529: t2 && r2.write(import_sisteransi.cursor.show), process.exit(0);
L530: return;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cord.mjsView on unpkg · L8989Trigger-reachable chain: manifest.bin -> dist/cord.mjs
L89: import { styleText } from "node:util";
L90: import { stdout, stdin } from "node:process";
L91: import * as l from "node:readline";
...
L426: function wrapAnsi(string, columns, options) {
L427: return String(string).normalize().split(CRLF_OR_LF).map((line) => exec(line, columns, options)).join("\n");
L428: }
...
L503: }
L504: var R = globalThis.process.platform.startsWith("win");
L505: var CANCEL_SYMBOL = /* @__PURE__ */ Symbol("clack:cancel");
...
L528: if (isActionKey([c2, a3, p], "cancel")) {
L529: t2 && r2.write(import_sisteransi.cursor.show), process.exit(0);
L530: return;
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cord.mjsFindings
2 Critical6 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cord.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cord.mjs
HighChild Processdist/cord.mjs
HighShell
HighCredential Redirect Persistencedist/cord.mjs
HighCommand Output Exfiltrationdist/cord.mjs
HighTrigger Reachable Credential Exfiltrationdist/cord.mjs
HighTrigger Reachable Command Output Exfiltrationdist/cord.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @flouviahq/cli@1.2.1.
See all versions of @flouviahq/cli for other recorded verdicts.
- Review the evidence and your use of @flouviahq/cli@1.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.