registry / @getbrevo/cli / 2.5.0
@getbrevo/cli@2.5.0
Brevo Developer CLI — create, manage apps and OAuth integrations
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe reviewed CLI entrypoint’s network and credential flows use Brevo service endpoints, and API-key login validates the key before saving it locally. Child-process execution is tied to opening the browser for login or starting the configured local project feature; no unrelated data collection or exfiltration was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI login or an explicit local project-server command.
Impact
Expected CLI authentication and local development-server behavior; no evidence of credential redirection or command-output exfiltration.
Mechanism
Login validates Brevo credentials and stores them locally; server startup runs the configured local feature entry with inherited environment variables.
AI rationale
The reviewed CLI entrypoint’s network and credential flows use Brevo service endpoints, and API-key login validates the key before saving it locally. Child-process execution is tied to opening the browser for login or starting the configured local project feature; no unrelated data collection or exfiltration was found.
Evidence
~/.brevo/credentials.json
Network endpoints3
api.brevo.comapp-store-bo-be.brevo.comoauth-cli.brevo.com
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as Brevo’s CLI and points its executable and main entry to dist/bin/index.js.
- API requests default to https://api.brevo.com, and the API URL override requires HTTPS except for localhost.
- OAuth refresh defaults to Brevo’s login service; the service URL override also requires HTTPS except for localhost.
- The browser opener runs only when invoked for login and uses fixed platform opener paths with the login URL as an argument.
- API-key login validates the key before saving credentials locally.
- The project server command starts a configured local feature entry and passes it the current environment.
Evidence against
- The entrypoint handles credentials, network requests, and child processes, but the reviewed flows align with CLI login and local project-server features.
- The package declares prepare and prepublishOnly scripts; these are build and publishing tasks, not install-time data collection.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
6 flaggeddist/bin/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @getbrevo/cli@2.2.0
matchedIdentity = npm:QGdldGJyZXZvL2NsaQ:2.2.0
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/index.jsView on unpkg177`),cmd.action((...actionArgs)=>{gatedBehind&&assertFeatureAvailable(gatedBehind);let opts=actionArgs.at(-2),positionalArgs=actionArgs.slice(0,-2);return def.handler(opts,...positio...
L178: `)}function createHelpFormatter(root){return(cmd,helper)=>cmd!==root?import_commander.Help.prototype.formatHelp.call(helper,cmd,helper):formatRootHelp(helper.commandDescription(cmd...
L179: `)}function hasEmittedJson(){return emitted}function buildJsonError(err){let envelope={error:{name:err instanceof Error?err.name:"Error",message:err instanceof Error?err.message:St...
High
Child Process
Package source references child process execution.
dist/bin/index.jsView on unpkg · L177708</html>
L709: `}function closeServer(server){return new Promise(resolveClose=>{server.close(()=>resolveClose())})}function startScopesWebServer(initialEntries,options={}){let html=renderScopesHt...
L710: ${messages.APP_SCOPES_UPDATE_DIFF(currentScopes,newScopes,added,removed)}
L711: `);let{confirmed}=await import_inquirer17.default.prompt([{type:"confirm",name:"confirmed",message:messages.APP_SCOPES_UPDATE_CONFIRM(appLabel||appId,appId),default:!1}]);if(!confi...
L712: `);throw new CliError(messages.APP_START_MISSING_FEATURE(available))}let featureConfig=FEATURES[feature];if(!featureConfig){let available=Object.keys(FEATURES).join(", ");throw new...
...
L714: `),resolve11())}),child.on("error",err=>{process.removeListener("SIGINT",onSignal),process.removeListener("SIGTERM",onSignal),
Findings
1 Critical5 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/bin/index.js
HighChild Processdist/bin/index.js
HighSame File Env Network Executiondist/bin/index.js
HighCredential Redirect Persistencedist/bin/index.js
HighCommand Output Exfiltrationdist/bin/index.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/index.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @getbrevo/cli@2.5.0.
See all versions of @getbrevo/cli for other recorded verdicts.
- Review the evidence and your use of @getbrevo/cli@2.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.