@getbrevo/cli@2.2.2
Brevo Developer CLI — create, manage apps and OAuth integrations
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends its version and a startup reason to a Brevo endpoint by default when its cache expires, and I found no setting to disable this check. The request contains no credentials or user or project identifiers, so this warrants a telemetry warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
At CLI startup when the 15-minute version-info cache is stale.
Impact
Brevo can observe the CLI version and approximate startup check activity. No account or project identifiers are sent in this request.
Mechanism
A GET request to `/cli/info` includes `cli_version` and `reason=startup`; the result is cached locally.
AI rationale
The CLI sends its version and a startup reason to a Brevo endpoint by default when its cache expires, and I found no setting to disable this check. The request contains no credentials or user or project identifiers, so this warrants a telemetry warning rather than a block.
Evidence
dist/bin/index.js~/.brevo/cli-info-cache.jsonBREVO_CONFIG_HOME/cli-info-cache.json
Network endpoints1
app-store-bo-be.brevo.com/cli/info
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI calls its version-info check during startup, before parsing the requested command.
- The check sends a GET request with only the CLI version and the reason `startup` as query parameters.
- The default endpoint is Brevo’s `app-store-bo-be.brevo.com` host at `/cli/info`.
- The response is cached for 15 minutes, so the network request occurs when the cache is stale.
- The manifest has `prepare` and `prepublishOnly` scripts, but no install or postinstall hook.
Evidence against
- The version check sends no credentials, user identity, project data, or command output.
- The check is a version and support-status lookup against a Brevo subdomain; the reported fields are limited to version and startup reason.
- OAuth and API credentials are used by the CLI’s Brevo login and API flows; no automatic forwarding to an unrelated host was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggeddist/bin/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @getbrevo/cli@2.3.0
matchedIdentity = npm:QGdldGJyZXZvL2NsaQ:2.3.0
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/index.jsView on unpkg132`)}function createHelpFormatter(root){return(cmd,helper)=>cmd!==root?import_commander.Help.prototype.formatHelp.call(helper,cmd,helper):formatRootHelp(helper.commandDescription(cmd...
L133: `)}function hasEmittedJson(){return emitted}function buildJsonError(err){let envelope={error:{name:err instanceof Error?err.name:"Error",message:err instanceof Error?err.message:St...
L134: ${messages.APP_LIST_EMPTY}
High
Child Process
Package source references child process execution.
dist/bin/index.jsView on unpkg · L132660</html>
L661: `}function closeServer(server){return new Promise(resolveClose=>{server.close(()=>resolveClose())})}function startScopesWebServer(initialEntries,options={}){let html=renderScopesHt...
L662: `);throw new CliError(messages.APP_START_MISSING_FEATURE(available))}let featureConfig=FEATURES[feature];if(!featureConfig){let available=Object.keys(FEATURES).join(", ");throw new...
...
L664: `),resolve11())}),child.on("error",err=>{process.removeListener("SIGINT",onSignal),process.removeListener("SIGTERM",onSignal),reject(new CliError(messages.APP_START_FAILED(feature,...
L665: Starting ${feature}...`);let childEnv={...process.env,PORT:String(port)};redirectUri&&(childEnv.REDIRECT_URI=redirectUri),await runChildProcess(entryFile,childEnv,feature)});var im...
L666: ${cancelledMessa
Findings
1 Critical5 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/bin/index.js
HighChild Processdist/bin/index.js
HighSame File Env Network Executiondist/bin/index.js
HighCredential Redirect Persistencedist/bin/index.js
HighCommand Output Exfiltrationdist/bin/index.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/index.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @getbrevo/cli@2.2.2.
See all versions of @getbrevo/cli for other recorded verdicts.
- Review the evidence and your use of @getbrevo/cli@2.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.