Loading npm security reports…

@glubean/cli@0.9.2: Clean npm security report (Allow) | LPM Firewall

registry / @glubean/cli / 0.9.2

@glubean/cli@0.9.2

The Glubean command-line tool. Run tests, sync results to Cloud, scaffold projects, manage environments.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a Glubean CLI with user-invoked scaffolding, MCP configuration, update checks, login, sync, and upload commands.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit CLI commands such as `glubean init`, `glubean config mcp`, `glubean run --upload`, `glubean sync`, `glubean login`, or `glubean upgrade`.

Impact

Creates or updates Glubean project files and optional hooks/MCP settings; can upload redacted test/run artifacts to configured Glubean API when requested.

Mechanism

User-invoked project scaffolding, cloud API upload/sync, MCP registration, and package update/install helpers

Rationale

The risky primitives are package-aligned and activated by explicit CLI commands; there is no lifecycle hook or hidden import-time mutation of broad AI-agent control surfaces. The MCP and git hook behavior is visible, user-invoked, and guarded by command flags, so it does not meet the block threshold.

Evidence

package.jsonbin/gb.jsdist/main.jsdist/commands/init.jsdist/commands/config_mcp.jsdist/commands/upgrade.jsdist/update_check.jsdist/lib/upload.jsdist/lib/auth.jsdist/commands/sync.jsglubean.yaml.env.env.secrets.gitignoreGLUBEAN.mdtests/api.test.ts

Source & flagged code

7 flagged

dist/commands/init.jsView file

Lines 851-896javascript

851

852Create a scoped contract instance with \`contract.http.with()\`, then define endpoints:

853

854\`\`\`typescript

855import { contract } from "@glubean/sdk";

856import { api } from "../configure.js";

857

858const userApi = contract.http.with("user", {

859 client: api,

860 security: "bearer",

861});

862

863// @contract

864export const createUser = userApi("create-user", {

865 endpoint: "POST /users",

866 feature: "User Registration",

867 description: "Create a new user account",

868 cases: {

869 success: {

870 description: "Valid registration creates user and returns profile",

871 body: { email: "test@example.com", password: "secure123" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L871

872 expect: { status: 201 },

873 },

874 duplicateEmail: {

875 description: "Already registered email is rejected",

876 body: { email: "existing@example.com", password: "secure123" },

Medium

Secret Pattern

Hardcoded password in dist/commands/init.js

dist/commands/init.jsView on unpkg · L876

877 expect: { status: 409 },

878 },

879 },

880});

881\`\`\`

882

883## Lifecycle

884

8851. Define: write contracts describing what the API should do

8862. Red: implementation does not satisfy the contract yet

8873. Green: implementation passes all contracts

8884. Iterate: add error cases, auth, schema validation

889

890## Rules

891

892- Fix the implementation, not the contract

893- Only change a contract when the business requirement changes

894- Use business language in descriptions, not technical jargon

895`;

896const GLUBEAN_SETUP_TEMPLATE = `/**

•matchType = previous_version_dangerous_delta matchedPackage = @glubean/cli@0.9.0 matchedIdentity = npm:QGdsdWJlYW4vY2xp:0.9.0 similarity = 0.769 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/init.jsView on unpkg

dist/lib/git.jsView file

Lines 1-23javascript

1/**

2 * Git helper utilities for the Glubean CLI.

3 */

4import { execFile } from "node:child_process";

5import { resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

dist/lib/git.jsView on unpkg · L3

6function

dist/version.jsView file

Lines 1-11javascript

1import { createRequire } from "node:module";

2import { dirname, resolve } from "node:path";

3import { fileURLToPath } from "node:url";

4const __dirname = dirname

dist/commands/config_mcp.jsView file

Lines 14-54javascript

14 const remove = options.remove ?? false;

15 if (remove) {

16 const target = options.target ?? (await promptTarget

dist/commands/upgrade.jsView file

Lines 23-63javascript

23 const res = await fetch(REGISTRY_URL, { signal: controller.signal });

24 clearTimeout(timeout);

25 if (res.ok) {

26 const data

Source & flagged code

7 flagged · loading source

dist/commands/init.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/init.jsView on unpkg

871patternName = generic_password severity = medium line = 871 matchedText = body: { ..." },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L871

876patternName = generic_password severity = medium line = 876 matchedText = body: { ..." },

Medium

Secret Pattern

Hardcoded password in dist/commands/init.js

dist/commands/init.jsView on unpkg · L876

dist/lib/git.jsView file

3*/ L4: import { execFile } from "node:child_process"; L5: import { resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

dist/lib/git.jsView on unpkg · L3

dist/version.jsView file

4const __dirname = dirname(fileURLToPath(import.meta.url)); L5: const require = createRequire(import.meta.url); L6: const pkg = require(resolve(__dirname, "../package.json"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/version.jsView on unpkg · L4

dist/commands/config_mcp.jsView file

34package = @glubean/cli; repositoryIdentity = glubean; dependency = @inquirer/prompts L34: async function promptTarget() { L35: const { select } = await import("@inquirer/prompts"); L36: return await select({

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/config_mcp.jsView on unpkg · L34

dist/commands/upgrade.jsView file

43try { L44: execSync("npm install -g glubean@latest", { stdio: "inherit" }); L45: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/upgrade.jsView on unpkg · L43

Source & flagged code

7 flagged

dist/commands/init.jsView file

Lines 851-896javascript

851

852Create a scoped contract instance with \`contract.http.with()\`, then define endpoints:

853

854\`\`\`typescript

855import { contract } from "@glubean/sdk";

856import { api } from "../configure.js";

857

858const userApi = contract.http.with("user", {

859 client: api,

860 security: "bearer",

861});

862

863// @contract

864export const createUser = userApi("create-user", {

865 endpoint: "POST /users",

866 feature: "User Registration",

867 description: "Create a new user account",

868 cases: {

869 success: {

870 description: "Valid registration creates user and returns profile",

871 body: { email: "test@example.com", password: "secure123" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L871

872 expect: { status: 201 },

873 },

874 duplicateEmail: {

875 description: "Already registered email is rejected",

876 body: { email: "existing@example.com", password: "secure123" },

Medium

Secret Pattern

Hardcoded password in dist/commands/init.js

dist/commands/init.jsView on unpkg · L876

877 expect: { status: 409 },

878 },

879 },

880});

881\`\`\`

882

883## Lifecycle

884

8851. Define: write contracts describing what the API should do

8862. Red: implementation does not satisfy the contract yet

8873. Green: implementation passes all contracts

8884. Iterate: add error cases, auth, schema validation

889

890## Rules

891

892- Fix the implementation, not the contract

893- Only change a contract when the business requirement changes

894- Use business language in descriptions, not technical jargon

895`;

896const GLUBEAN_SETUP_TEMPLATE = `/**

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/init.jsView on unpkg

dist/lib/git.jsView file

Lines 1-23javascript

1/**

2 * Git helper utilities for the Glubean CLI.

3 */

4import { execFile } from "node:child_process";

5import { resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

dist/lib/git.jsView on unpkg · L3

6function

dist/version.jsView file

Lines 1-11javascript

1import { createRequire } from "node:module";

2import { dirname, resolve } from "node:path";

3import { fileURLToPath } from "node:url";

4const __dirname = dirname

dist/commands/config_mcp.jsView file

Lines 14-54javascript

14 const remove = options.remove ?? false;

15 if (remove) {

16 const target = options.target ?? (await promptTarget

dist/commands/upgrade.jsView file

Lines 23-63javascript

23 const res = await fetch(REGISTRY_URL, { signal: controller.signal });

24 clearTimeout(timeout);

25 if (res.ok) {

26 const data

@glubean/cli@0.9.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code