registry  /  @getfrontline/cli  /  1.1.0

@getfrontline/cli@1.1.0

Frontline CLI — Public API (agents, workflows, billing, tables, objects) + Max chat/admin REST from your terminal

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 94 file(s), 365 KB of source, external domains: 127.0.0.1, api.example.com, prod-api.getfrontline.ai, registry.npmjs.org

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./scripts/runPostinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/max/browserLogin.jsView file
•matchType = normalized_sha256 matchedPackage = @getfrontline/cli@1.0.20 matchedPath = dist/max/browserLogin.js matchedIdentity = npm:QGdldGZyb250bGluZS9jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/max/browserLogin.jsView on unpkg
scripts/runPostinstall.mjsView file
•matchType = normalized_sha256 matchedPackage = @getfrontline/cli@1.0.20 matchedPath = scripts/runPostinstall.mjs matchedIdentity = npm:QGdldGZyb250bGluZS9jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/runPostinstall.mjsView on unpkg

Findings

3 High3 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/max/browserLogin.js
HighKnown Malware Source Similarityscripts/runPostinstall.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings