Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@gitbook/cli@0.29.2: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 13 finding(s) warrant review before installing.

View on npm All versions

registry / @gitbook/cli / 0.29.2

@gitbook/cli@0.29.2

CLI to build and publish integrations on GitBook.com

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 2 file(s), 260 KB of source, external domains: app.gitbook.com, feross.org, github.com, nodejs.org

Oversized source lightweight scan

dist/cli.js2.17 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsShellHighEntropyStringsUrlStrings

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

app.gitbook.com

feross.org

github.com

nodejs.org

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 2275552 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 2275552 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Findings

2 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/cli.js

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

72%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Maintainersgitbook-bot, samypesse, jpreynat +5

Version0.29.2

PublishedJul 18, 2026

Licensenone

Dependencies14

Integrityverified

Package size294 KB

Files5

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → gitbook

Runtimenode >=18.0.0

Artifact2.18 MB · 5 files1 signature(s) · provenance

Install lifecyclepostinstall

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsNoLicenseWildcardDependency

LPM CLI

Source & flagged code

4 flagged

package.jsonView file

Lines 16-56json

16 "zod": "^3.25.42",

17 "chokidar": "^4.0.1",

18 "miniflare": "^4.20250525.0",

19 "@1password/op-js": "^0.1.13"

20 },

21 "devDependencies": {

22 "@gitbook/tsconfig": "*",

23 "@schemastore/package": "^0.0.10",

24 "@types/prompts": "^2.0.14",

25 "typescript": "^5.6.2"

26 },

27 "files": [

28 "dist/**",

29 "postinstall.js"

30 ],

31 "scripts": {

32 "generate-commands": "bun run ../../scripts/generate-commands.ts",

33 "prebuild": "bun run generate-commands",

34 "build": "./build.sh",

35 "prepack": "bun run build",

36 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 "test": "bun test",

38 "typecheck": "tsc --noEmit"

39 },

40 "engines": {

41 "node": ">=18.0.0"

42 },

43 "bin": {

44 "gitbook": "./cli.js"

45 },

46 "publishConfig": {

47 "access": "public",

48 "registry": "https://registry.npmjs.org/"

49 },

50 "repository": {

51 "type": "git",

52 "url": "https://github.com/GitbookIO/integrations.git",

53 "directory": "packages/cli"

54 }

55}

56

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 2275552 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 2275552 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg