registry / @frontic/cli / 0.0.0-canary-20260708160643

@frontic/cli@0.0.0-canary-20260708160643

Frontic CLI for managing your storefront projects

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `frontic mcp init --client <client>` or other Frontic CLI commands.

Impact

Warn-level agent control-surface mutation; no confirmed malicious install-time or stealth behavior.

Mechanism

Explicit CLI writes project, env, generated SDK, context, and MCP config files.

Rationale

Source inspection shows no install-time execution, hidden shell execution, non-Frontic exfiltration, or stealth persistence. Because the package can explicitly mutate AI-agent MCP configuration to remote servers, it fits warn-level agent capability abuse rather than clean or publish-block malicious behavior.

Evidence

package.jsondist/frontic.mjsREADME.md.frontic/api_session.jwt.frontic/project.json.frontic/version-check-cache.jsonfetch-api.d.tsgenerated-types.d.tsgenerated-client.tsquery-types.tsmetadata.jsonfetch-api.spec.yamlfetch-api.debug.yaml.claude/CLAUDE.md.claude/rules.claude/skills.cursor/rules/project-rules.md.cursor/rules.cursor/skills

Network endpoints6

backend.frontic.com/app.frontic.com/mcp.frontic.com/mcpdocs.frontic.com/mcpregistry.npmjs.org/@frontic/cli/latestlocalhost:3008

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/frontic.mjs exposes explicit `frontic mcp init --client <...>` that writes MCP config for cursor/claude/windsurf/vscode/codex.
Codex target writes to homedir `.codex/config.toml`; other clients write `.cursor/mcp.json`, `.mcp.json`, `.vscode/mcp.json`, or Windsurf config.
MCP servers added are remote HTTP endpoints `https://mcp.frontic.com/mcp` and `https://docs.frontic.com/mcp`.

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts; install does not mutate agent config.
AI-agent config mutation is explicit user-invoked CLI behavior with a required `--client` and interactive server selection.
Network calls are Frontic/product-aligned: backend/app Frontic APIs, docs/MCP, login, and npm latest-version check.
File writes are expected CLI outputs: token/project config, generated SDK files, skills/rules, `.env.studio`, and MCP config.
No evidence of credential harvesting beyond user login token/project credential commands, and no exfiltration to non-Frontic hosts.
child_process import appears from bundled commander subcommand support, not package-specific hidden execution.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 105 KB of source, external domains: app.frontic.com, app.frontstack.test, backend.frontic.com, backend.frontstack.test, docs.frontic.com, mcp.frontic.com, registry.npmjs.org

Source & flagged code

3 flagged

dist/frontic.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2var Bt=Object.defineProperty;var l=(o,e)=>Bt(o,"name",{value:e,configurable:!0});var ce,le,ue,de,pe,fe,te;import Jt from"events";import zt from"child_process";import Te from"path";import _,{existsSync as ge,readFileSync as nt,mkdirSync as Yt,writeFileSync as Kt}from"fs";import Zt from"process";import a from"chalk";import y,{join as Qt,dirname as Xt}from"pathe";import je from"js-yaml";import eo from"dotenv";import{defu as to}from"defu";import oo from"http";import no from"open";import L from"handlebars";import ro,{astToString as io}from"openapi-typescript";import N from"prompts";import rt from"o ...

3`).replace(/^/gm," ".repeat(i))}l(u,"formatList");let p=[`Usage: ${t.commandUsage(e)}`,""];const c=t.commandDescription(e);c.length>0&&(p=p.concat([t.wrap(c,r,0),""]));const h=t.visibleArguments(e).map(v=>d(t.argumentTerm(v),t.argumentDescription(v)));h.length>0&&(p=p.concat(["Arguments:",u(h),""]));const g=t.visibleOptions(e).map(v=>d(t.optionTerm(v),t.optionDescription(v)));if(g.length>0&&(p=p.concat(["Options:",u(g),""])),this.showGlobalOptions){const v=t.visibleGlobalOptions(e).map(C=>d(t.optionTerm(C),t.optionDescription(C)));v.length>0&&(p=p.concat(["Global Options:",u(v),""]))}const w=t ...

High

Child Process

Package source references child process execution.

dist/frontic.mjsView on unpkg · L1

4`)}padWidth(e,t){return Math.max(t.longestOptionTermLength(e,t),t.longestGlobalOptionTermLength(e,t),t.longestSubcommandTermLength(e,t),t.longestArgumentTermLength(e,t))}wrap(e,t,n,r=40){const i=" \\f\\t\\v\xA0\u1680\u2000-\u200A\u202F\u205F\u3000\uFEFF",s=new RegExp(`[\\n][${i}]+`);if(e.

5`,`

6`),c=" ".repeat(n),g="\\s\u200B",w=new RegExp(`

7|.{1,${d-1}}([${g}]|$)|[^${g}]+?([${g}]|$)`,"g"),v=p.match(w)||[];return u+v.map((C,S)=>C===`

8`?"":(S>0?c:"")+C.trimEnd()).join(`

9`)}},l(de,"Help"),de);Fe.Help=fo;var Ee={};const{InvalidArgumentError:ho}=ie;let mo=(pe=class{constructor(e,t){this.flags=e,this.description=t||"",this.required=e.includes("<"),this

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?`

11(Did you mean ${n[0]}?)`:""}l($o,"suggestSimilar$1"),at.suggestSimilar=$o;const _o=Jt.EventEmitter,Ne=zt,B=Te,Ie=_,A=Zt,{Argument:vo,humanReadableArgName:Co}=ye,{CommanderError:De}=ie,{Help:Oo}=Fe,{Option:lt,DualOptions:jo}=Ee,{suggestSimilar:ut}=at;let Eo=(te=class extends _o{constructor(

12- specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this._registerCommand(e),e.parent=this,e._checkForBrokenPassThrough(),this}createArgument(e,t){return new vo(e,t)}argument(e,t,n,r){const i=this.createArgument(e,t);return typeof n=="function"?i.default(r).argParser(n):i.default(n),this.addArgument(i),this}arguments(e){return e.trim().split(/ +/).forEach(t=>{this.argument(t)}),this}addArgument(e){const t=this.registeredArguments.slice(-1)[0];if(t&&t.variadic)throw new Error(`only the l ...

13Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e:this._exitCallback=t=>{if(t.code!=="commander.executeSubCommandAsync")throw t},this}_exit(e,t,n){this._exitCallback&&this._exitCallback(new De(e,t,n)),A.exit(e)}action(e){const t=l(n=>{const r=this.registeredArguments.length,i=n.slice(0,r);return this._storeOptionsAsProperties?i[r]=this:i[r]=this.opts(),i.push(this),e.apply(this,i)},"listener");return this._actionHandler=t,this}createOption(e,t){return new lt(e,t)}_ ...

14- already used by option '${t.flags}'`)}this.options.push(e)}_registerCommand(e){const t=l(r=>[r.name()].concat(r.aliases()),"knownBy"),n=t(e).find(r=>this._findCommand(r));if(n){const r=t(this._findCommand(n)).join("|"),i

15 - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

16 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

17 - ${h}`;throw new Error(g)}else if(c.code==="EACCES")throw new Error(`'${s}' not executable`);if(!p)A.exit(1);else{const h=new De(1,"commander.executeSubCommandAsync","(error)");h.nestedError=c,p(h)}}),this.runningCommand=u}_dispatchSubcommand(e,t,n){const r=this._findCommand(e);r||this.help({error:!0});let i;return i=this._chainOrCallSubCommandHook(i,r,"preSubcommand"),i=this._chainOrCall(i,()=>{if(r._executableHandler)this._executeSubCommand(r,t.concat(n));else return r._parseCommand(t,n)}),i}_dispatchHelpCommand(e){e||this.help();const t=this._findCommand(e);return t&&!t._executableHandler ...

18`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError=="string"?this._outputConfiguration.writeErr(`${this._showHelpAfterError}

19`):this._showHelpAfterError&&(this._outputConfiguration.writeErr(`

20`),this.outputHelp({error:!0}));const n=t||{},r=n.exitCode||1,i=n.code||"commander.error";this._exit(r,i,e)}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in A.env){const t=e.attributeName();(this.getOptionValue

21`),this._exit(0,"commander.version",e)}),this}description(e,t){return e===void 0&&t===void 0?this._description:(this._description=e,t&&(this._argsDescription=t),this)}summary(e){return e===void 0?this._summary:(this._summary=e,this)}alias(e){if(e===void 0)return this._aliases[0];let t=this;if(this.commands.length!==0&&this.commands[this.commands.length-1]._executableHandler&&(t=this.commands[this.commands.length-1]),e===t._name)throw new Error("Command alias can't be the same as its name");const n=this.parent?._findCommand(e);if(n){const r=[n.name()].concat(n.aliases()).join("|");throw new Err ...

22Expecting one of '${n.join("', '")}'`);const r=`${e}Help`;return this.on(r,i=>{let s;typeof t=="function"?s=t({error:i.error,command:i.command}):s=t,s&&i.write(`${s}

23`)}),this}_outputHelpIfRequested(e){const t=this._getHelpOption();t&&e.find(r=>t.is(r))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}},l(te,"Command"),te);function dt(o){return o.map(e=>

24Run ${a.hex("#7c3bed")("frontic project")} to select a Frontic project`);return process.env.NODE_TLS_REJECT_UNAUTHORIZED=process.env.FRONTIC_CLI_DEV_MODE?"0":"1",await I(En,{method:"GET",headers:{"Content-Type":"application/yaml",Authorization:`Bearer ${r()}`,"FS-Project":f},parseResponse:l(E=>{m?.(E);try{return je.load(E)}catch{throw new Error("Invalid API specification. The API specification must be a valid YAML file.")}},"parseResponse")})}catch(b){throw"data"in b&&"message"in b.data?new Error(`Server error: ${b.data.message}`):b}},"getFetchApiSpec"),r=l(()=>{const f=y.join(J,We);return _.e ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/frontic.mjsView on unpkg · L13

25Run ${a.hex("#7c3bed")("frontic project")} to select a Frontic project`);process.env.NODE_TLS_REJECT_UNAUTHORIZED=process.env.FRONTIC_CLI_DEV_MODE?"0":"1";try{return await I(`${se}api/studio/context/skills`,{method:"GET",headers:{"Content-Type":"application/json",Cookie:`access_token=${r()}`,"FS-Project":f}})}catch{return[]}}catch(f){throw"data"in f&&"message"in f.data?new Error(`Server error: ${f.data.message}

26Run ${a.hex("#7c3bed")("frontic project")} to select a Frontic project`);process.env.NODE_TLS_REJECT_UNAUTHORIZED=process.env.FRONTIC_CLI_DEV_MODE?"0":"1";try{return await I(`${se}api/studio/context/${f}`,{method:"GET",headers:{"Content-Type":"application/json",Cookie:`access_token=${r()}`,"FS-Project":m}})}catch{return null}}catch(m){throw"data"in m&&"message"in m.data?new Error(`Server error: ${m.data.message}`):m}},"getDocument"),getSkillFiles:l(async f=>{try{const m=u();if(m==null)throw new Error(`You have no project selected

27Run ${a.hex("#7c3bed")("frontic project")} to select a Frontic project`);process.env.NODE_TLS_REJECT_UNAUTHORIZED=process.env.FRONTIC_CLI_DEV_MODE?"0":"1";try{return await I(`${se}api/studio/context/${f}/files`,{method:"GET",headers:{"Content-Type":"application/json",Cookie:`access_token=${r()}`,"FS-Project":m}})}catch{return[]}}catch(m){throw"data"in m&&"message"in m.data?new Error(`Server error: ${m.data.message}`):m}},"getSkillFiles"),downloadSkillFile:l(async(f,m)=>{try{const b=u();if(b==null)throw new Error(`You have no project selected

28Run ${a.hex("#7c3bed")("frontic project")} to select a Frontic project`);process.env.NODE_TLS_REJECT_UNAUTHORIZED=process.env.FRONTIC_CLI_DEV_MODE?"0":"1";try{return await I(`${se}api/studio/context/${f}/files/${m}/download`,{method:"GET",responseType:"arrayBuffer",headers:{Cookie:`access_token=${r()}`,"FS-Project":b}})}catch{return null}}catch(b){throw"data"in b&&"message"in b.data?new Error(`Server error: ${b.data.message}`):b}},"downloadSkillFile"),getRules:l(async()=>{try{const f=u();if(f==null)throw new Error(`You have no project selected

29Run ${a.hex("#7c3bed")("frontic project")} to select a Frontic project`);process.env.NODE_TLS_REJECT_UNAUTHORIZED=process.env.FRONTIC_CLI_DEV_MODE?"0":"1";try{return await I(`${se}api/studio/context/rules`,{method:"GET",headers:{"Content-Type":"application/json",Cookie:`access_token=${r()}`,"FS-Project":f}})}catch(m){if(m?.status===404)return[];throw m}}catch(f){throw"data"in f&&"message"in f.data?new Error(`Server error: ${f.data.message}`):f}},"getRules"),getProjectRules:l(async()=>{try{const f=u();if(f==null)throw new Error(`You have no project selected

30Run ${a.hex("#7c3bed")("frontic project")} to select a Frontic project`);process.env.NODE_TLS_REJECT_UNAUTHORIZED=process.env.FRONTIC_CLI_DEV_MODE?"0":"1";try{return await I(`${se}api/studio/context/system/studio-rules`,{method:"GET",headers:{"Content-Type":"application/json",Cookie:`access_token=${r()}`,"FS-Project":f}})}catch(m){if(m?.status===404)return null;throw m}}catch(f){throw"data"in f&&"message"in f.data?new Error(`Server error: ${f.data.message}`):f}},"getProjectRules")}},"auth"),jt=l(()=>{const o=l(t=>{const n=y.join(t,"metadata.json");if(_.existsSync(n)){const r=_.readFileSync(n," ...

31`+g.error);let w="";try{w=io(await ro(g))}catch(S){throw new Error(`Invalid API Specification: ${S.message}`)}const v=s({paths:g.paths,components:g.components}),C=p({components:g.components,paths:g.paths,servers:g.servers,namespace:On()?"Frontstack":"Frontic"});return{_schemaTypes:w,_types:v,_client:C,_query:h,_specFile:g}},"generate");const tt=class tt extends Error{constructor(e){super(e),this.name="AccessError"}};l(tt,

32See ${e.docs}`:"";throw new X(`${d}${u}`)}l(_e,"requireFeatureFlag");async function xe(o,e={}){const t=await xt();if(!t)throw new X("Not logged in. Run `frontic login` first.");const n=t.permissions;if((Array.isArray(n)?n:[]).includes(o))return;const i=e.cta??(e.action?`Your account doesn't have permission for ${e.action}.`:`Your account doesn't have the "${o}" permission.`);throw new X(`${i}

33Ask an organization admin to grant "${o}".`)}l(xe,"requirePermission");var Rt=Object.freeze({__proto__:null,AccessError:X,ensureLoggedIn:ae,ensureProjectSelected:At,hasFeatureFlag:kt,requireFeatureFlag:_e,requirePermission:xe,requireStudioAccess:St,setInteractive:U});const{getProjects:Dn,writeProject:Je}=D(),ze=l(async o=>{let e=o.project??void 0;if(!await ae()){console.log(`You are not logged in. Please run ${a.hex("#7c3bed")("frontic login")} to login`);return}let n=[];try{n=await Dn()}catch{console.log(`You are not logged in. Please run ${a.hex("#7c3bed")("frontic login")} to login`);return ...

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/frontic.mjsView file

1#!/usr/bin/env node L2: var Bt=Object.defineProperty;var l=(o,e)=>Bt(o,"name",{value:e,configurable:!0});var ce,le,ue,de,pe,fe,te;import Jt from"events";import zt from"child_process";import Te from"path";... L3: `).replace(/^/gm," ".repeat(i))}l(u,"formatList");let p=[`Usage: ${t.commandUsage(e)}`,""];const c=t.commandDescription(e);c.length>0&&(p=p.concat([t.wrap(c,r,0),""]));const h=t.vi...

High

Child Process

Package source references child process execution.

dist/frontic.mjsView on unpkg · L1

13Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e... L14: - already used by option '${t.flags}'`)}this.options.push(e)}_registerCommand(e){const t=l(r=>[r.name()].concat(r.aliases()),"knownBy"),n=t(e).find(r=>this._findCommand(r));if(n){... L15: - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead ... L22: Expecting one of '${n.join("', '")}'`);const r=`${e}Help`;return this.on(r,i=>{let s;typeof t=="function"?s=t({error:i.error,command:i.command}):s=t,s&&i.write(`${s} L23: `)}),this}_outputHelpIfRequested(e){const t=this._getHelpOption();t&&e.find(r=>t.is(r))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}},l(te,"Command"... L24: Run ${a.hex("#7c3bed")("frontic project")} to select a Frontic project`);return process.env.NODE_TLS_REJECT_UNAUTHORIZED=process.env.FRONTIC_CLI_DEV_MODE?"0":"1",await I(En,{method...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/frontic.mjsView on unpkg · L13

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}l($o,"suggestSimilar$1"),at.suggestSimilar=$o;const _o=Jt.EventEmitter,Ne=zt,B=Te,Ie=_,A=Zt,{Argument:vo,humanReadableArgName:Co}=ye,{CommanderError:De}... L12: - specify the name in Command constructor or using .name()`);return t=t||{},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this._registerComma... L13: Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e... L14: - already used by option '${t.flags}'`)}this.options.push(e)}_registerCommand(e){const t=l(r=>[r.name()].concat(r.aliases()),"knownBy"),n=t(e).find(r=>this._findCommand(r));if(n){... L15: - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead ... L22: Expecting one of '${n.join("', '")}'`);const r=`${e}Help`;return this.on(r,i=>{let s;typeof t=="function"?s=t({error:i.error,command:i.command}):s=t,s&&i.write(`${s} L23: `)}),this}_outputHelpIfRequested(e){const t=this._getHelpOp

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/frontic.mjsView on unpkg · L10

Findings

3 High1 Medium5 Low

HighChild Processdist/frontic.mjs

HighSame File Env Network Executiondist/frontic.mjs

HighCommand Output Exfiltrationdist/frontic.mjs

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/frontic.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/frontic.mjsView on unpkg · L1

5`,`

6`),c=" ".repeat(n),g="\\s\u200B",w=new RegExp(`

7|.{1,${d-1}}([${g}]|$)|[^${g}]+?([${g}]|$)`,"g"),v=p.match(w)||[];return u+v.map((C,S)=>C===`

8`?"":(S>0?c:"")+C.trimEnd()).join(`

9`)}},l(de,"Help"),de);Fe.Help=fo;var Ee={};const{InvalidArgumentError:ho}=ie;let mo=(pe=class{constructor(e,t){this.flags=e,this.description=t||"",this.required=e.includes("<"),this

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?`

13Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e:this._exitCallback=t=>{if(t.code!=="commander.executeSubCommandAsync")throw t},this}_exit(e,t,n){this._exitCallback&&this._exitCallback(new De(e,t,n)),A.exit(e)}action(e){const t=l(n=>{const r=this.registeredArguments.length,i=n.slice(0,r);return this._storeOptionsAsProperties?i[r]=this:i[r]=this.opts(),i.push(this),e.apply(this,i)},"listener");return this._actionHandler=t,this}createOption(e,t){return new lt(e,t)}_ ...

15 - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

16 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

18`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError=="string"?this._outputConfiguration.writeErr(`${this._showHelpAfterError}

19`):this._showHelpAfterError&&(this._outputConfiguration.writeErr(`

22Expecting one of '${n.join("', '")}'`);const r=`${e}Help`;return this.on(r,i=>{let s;typeof t=="function"?s=t({error:i.error,command:i.command}):s=t,s&&i.write(`${s}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/frontic.mjsView on unpkg · L13

Long lines were clipped for display.