registry / @getbrevo/cli / 2.6.0
@getbrevo/cli@2.6.0
Brevo Developer CLI — create, manage apps and OAuth integrations
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged process execution belongs to agent CLI registration, while the inspected credential flows target Brevo API or OAuth services. The manifest’s lifecycle scripts are for development and publishing, with no install-time attack identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI entrypoint loads on import or command invocation; agent registration runs only through its command flow.
Impact
No malicious impact identified.
Mechanism
The inspected network and process activity serves Brevo API and OAuth operations and explicit agent CLI registration. No unrelated credential forwarding was found.
AI rationale
The flagged process execution belongs to agent CLI registration, while the inspected credential flows target Brevo API or OAuth services. The manifest’s lifecycle scripts are for development and publishing, with no install-time attack identified.
Network endpoints4
api.brevo.comoauth-cli.brevo.comapp-store-bo-be.brevo.comregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as Brevo’s CLI, with its main entry and executable at dist/bin/index.js.
- API requests use the configured Brevo API base and attach the credential as an authentication header.
- OAuth refresh sends the refresh token to the configured Brevo OAuth proxy endpoint.
- The flagged child-process code runs an agent CLI without a shell and captures its output for local result handling.
- API-key login validates the key through the account service before saving credentials.
Evidence against
- The package has no install or postinstall hook; prepare and prepublishOnly are development and publishing scripts.
- The inspected startup path fetches CLI information and proceeds to command parsing; no unrelated collector or credential redirect was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flaggeddist/bin/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @getbrevo/cli@2.2.0
matchedIdentity = npm:QGdldGJyZXZvL2NsaQ:2.2.0
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/index.jsView on unpkg177`),cmd.action((...actionArgs)=>{gatedBehind&&assertFeatureAvailable(gatedBehind);let opts=actionArgs.at(-2),positionalArgs=actionArgs.slice(0,-2);return def.handler(opts,...positio...
L178: `)}function createHelpFormatter(root){return(cmd,helper)=>cmd!==root?import_commander.Help.prototype.formatHelp.call(helper,cmd,helper):formatRootHelp(helper.commandDescription(cmd...
L179: `)}function hasEmittedJson(){return emitted}function buildJsonError(err){let envelope={error:{name:err instanceof Error?err.name:"Error",message:err instanceof Error?err.message:St...
High
Child Process
Package source references child process execution.
dist/bin/index.jsView on unpkg · L177177`),cmd.action((...actionArgs)=>{gatedBehind&&assertFeatureAvailable(gatedBehind);let opts=actionArgs.at(-2),positionalArgs=actionArgs.slice(0,-2);return def.handler(opts,...positio...
L178: `)}function createHelpFormatter(root){return(cmd,helper)=>cmd!==root?import_commander.Help.prototype.formatHelp.call(helper,cmd,helper):formatRootHelp(helper.commandDescription(cmd...
L179: `)}function hasEmittedJson(){return emitted}function buildJsonError(err){let envelope={error:{name:err instanceof Error?err.name:"Error",message:err instanceof Error?err.message:St...
Findings
1 Critical6 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/bin/index.js
HighChild Processdist/bin/index.js
HighShelldist/bin/index.js
HighSame File Env Network Executiondist/bin/index.js
HighCredential Redirect Persistencedist/bin/index.js
HighCommand Output Exfiltrationdist/bin/index.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/index.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @getbrevo/cli@2.6.0.
See all versions of @getbrevo/cli for other recorded verdicts.
- Review the evidence and your use of @getbrevo/cli@2.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.