Loading npm security reports…

@glubean/cli@0.10.3: Suspicious npm security report (Warn) | LPM Firewall

registry / @glubean/cli / 0.10.3

@glubean/cli@0.10.3

⚠ Under review

The Glubean command-line tool. Run tests, sync results to Cloud, scaffold projects, manage environments.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 40 file(s), 567 KB of source, external domains: api.example.com, api.glubean.com, dummyjson.com, github.com, glubean.com, platform.glubean.com, registry.npmjs.org

Source & flagged code

7 flagged

dist/commands/init.jsView file

Lines 851-896javascript

851

852Create a scoped contract instance with \`contract.http.with()\`, then define endpoints:

853

854\`\`\`typescript

855import { contract } from "@glubean/sdk";

856import { api } from "../configure.js";

857

858const userApi = contract.http.with("user", {

859 client: api,

860 security: "bearer",

861});

862

863// @contract

864export const createUser = userApi("create-user", {

865 endpoint: "POST /users",

866 feature: "User Registration",

867 description: "Create a new user account",

868 cases: {

869 success: {

870 description: "Valid registration creates user and returns profile",

871 body: { email: "test@example.com", password: "secure123" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L871

872 expect: { status: 201 },

873 },

874 duplicateEmail: {

875 description: "Already registered email is rejected",

876 body: { email: "existing@example.com", password: "secure123" },

Medium

Secret Pattern

Hardcoded password in dist/commands/init.js

dist/commands/init.jsView on unpkg · L876

877 expect: { status: 409 },

878 },

879 },

880});

881\`\`\`

882

883## Lifecycle

884

8851. Define: write contracts describing what the API should do

8862. Red: implementation does not satisfy the contract yet

8873. Green: implementation passes all contracts

8884. Iterate: add error cases, auth, schema validation

889

890## Rules

891

892- Fix the implementation, not the contract

893- Only change a contract when the business requirement changes

894- Use business language in descriptions, not technical jargon

895`;

896const GLUBEAN_SETUP_TEMPLATE = `/**

dist/lib/git.jsView file

Lines 1-23javascript

1/**

2 * Git helper utilities for the Glubean CLI.

3 */

4import { execFile } from "node:child_process";

5import { resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

dist/lib/git.jsView on unpkg · L3

6function

dist/version.jsView file

Lines 1-11javascript

1import { createRequire } from "node:module";

2import { dirname, resolve } from "node:path";

3import { fileURLToPath } from "node:url";

4const __dirname = dirname

dist/commands/config_mcp.jsView file

Lines 14-54javascript

14 const remove = options.remove ?? false;

15 if (remove) {

16 const target = options.target ?? (await promptTarget

dist/commands/upgrade.jsView file

Lines 23-63javascript

23 const res = await fetch(REGISTRY_URL, { signal: controller.signal });

24 clearTimeout(timeout);

25 if (res.ok) {

26 const data

dist/commands/qa.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @glubean/cli@0.9.5 matchedIdentity = npm:QGdsdWJlYW4vY2xp:0.9.5 similarity = 0.821 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/qa.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/commands/init.jsView file

Source & flagged code

7 flagged

dist/commands/init.jsView file

Lines 851-896javascript

851

852Create a scoped contract instance with \`contract.http.with()\`, then define endpoints:

853

854\`\`\`typescript

855import { contract } from "@glubean/sdk";

856import { api } from "../configure.js";

857

858const userApi = contract.http.with("user", {

859 client: api,

860 security: "bearer",

861});

862

863// @contract

864export const createUser = userApi("create-user", {

865 endpoint: "POST /users",

866 feature: "User Registration",

867 description: "Create a new user account",

868 cases: {

869 success: {

870 description: "Valid registration creates user and returns profile",

871 body: { email: "test@example.com", password: "secure123" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L871

872 expect: { status: 201 },

873 },

874 duplicateEmail: {

875 description: "Already registered email is rejected",

876 body: { email: "existing@example.com", password: "secure123" },

Medium

Secret Pattern

Hardcoded password in dist/commands/init.js

dist/commands/init.jsView on unpkg · L876

877 expect: { status: 409 },

878 },

879 },

880});

881\`\`\`

882

883## Lifecycle

884

8851. Define: write contracts describing what the API should do

8862. Red: implementation does not satisfy the contract yet

8873. Green: implementation passes all contracts

8884. Iterate: add error cases, auth, schema validation

889

890## Rules

891

892- Fix the implementation, not the contract

893- Only change a contract when the business requirement changes

894- Use business language in descriptions, not technical jargon

895`;

896const GLUBEAN_SETUP_TEMPLATE = `/**

dist/lib/git.jsView file

Lines 1-23javascript

1/**

2 * Git helper utilities for the Glubean CLI.

3 */

4import { execFile } from "node:child_process";

5import { resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

dist/lib/git.jsView on unpkg · L3

6function

dist/version.jsView file

Lines 1-11javascript

1import { createRequire } from "node:module";

2import { dirname, resolve } from "node:path";

3import { fileURLToPath } from "node:url";

4const __dirname = dirname

dist/commands/config_mcp.jsView file

Lines 14-54javascript

14 const remove = options.remove ?? false;

15 if (remove) {

16 const target = options.target ?? (await promptTarget

dist/commands/upgrade.jsView file

Lines 23-63javascript

23 const res = await fetch(REGISTRY_URL, { signal: controller.signal });

24 clearTimeout(timeout);

25 if (res.ok) {

26 const data

dist/commands/qa.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/qa.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code