registry / @granular-software/sdk / 0.4.68

@granular-software/sdk@0.4.68

TypeScript SDK and CLI for Granular - define, build, and deploy AI sandboxes

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Running granular login or granular init sends an API key to a hard-coded workers.dev production gateway. The CLI then stores the key in the consumer project's .env.local.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs granular login or granular init and supplies or already has GRANULAR_API_KEY.

Impact

The supplied API credential can be disclosed to the gateway operator and retained in the project.

Mechanism

Bearer credential forwarding to a fixed non-package-aligned gateway.

Attack narrative

The CLI defaults to a workers.dev gateway while its authentication site uses app.granular.software. Login and init validate a supplied Granular API key by sending it as a Bearer token to that gateway, then save it to .env.local. Init additionally writes AI-agent skill and configuration files into the current project. The lack of an install hook limits activation to explicit CLI use, but the default credential destination is an unverified external gateway.

AI rationale

The default endpoint and Bearer authorization path establish concrete credential forwarding to a non-package-aligned host. This is sufficient for a publish block despite requiring an explicit CLI action.

Evidence

dist/cli/index.js.env.local.env.granularrc.agents/openai.yaml.agents/skills/.cursor/rules/.claude/skills/CLAUDE.md

Network endpoints2

cf-api-gateway.arthur6084.workers.devapp.granular.software

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The default production API is a fixed workers.dev host unrelated to the package's Granular domain.
The CLI attaches the supplied API key as a Bearer credential to requests to that endpoint.
The login command validates the supplied key against the configured endpoint before saving it locally.
The explicit init command also creates files for Codex, Cursor, and Claude in the consumer project.

Evidence against

package.json has no npm install, preinstall, or postinstall hook.
Credential transmission is reached through user-run login or init commands, not package installation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 4.86 MB of source, external domains: 127.0.0.1, api.openai.com, app.granular.software, checkout.example, developers.openai.com, docs.granular.dev, dotenvx.com, example.com, github.com, northwind.example, rivergate.example, www.w3.org

Source & flagged code

8 flagged

dist/cli/index.jsView file

6var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L6

6Trigger-reachable chain: manifest.bin -> dist/cli/index.js L6: var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L6

7var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto');

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: var readline = require('readline'); var readline__namespace = /*#__PURE__*/_interopNamespace(readline); fs__namespace.writeFileSync(filePath, JSON.stringify(project, null, 2) + "\n", "utf-8"); fs__namespace.writeFileSync( fs__namespace.writeFileSync(filePath, JSON.stringify(merged, null, 2) + "\n", "utf-8"); fs__namespace.writeFileSync(envLocalPath, content, "utf-8"); fs__namespace.writeFileSync(gitignorePath, content + section, "utf-8"); "No API key found. Run `granular login` or set GRANULAR_API_KEY environment variable."

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L6

6Cross-file remote execution chain: dist/cli/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L6: var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L6

6Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli/index.js L6: var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli/index.jsView on unpkg · L6

dist/agent-evals.jsView file

20712try { L20713: new Function(`return (async () => { L20714: ${withoutImports}

High

Eval

Package source references dynamic code evaluation.

dist/agent-evals.jsView on unpkg · L20712

Source & flagged code

8 flagged · loading source

dist/cli/index.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L6

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L6

7var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto');

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L6

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L6

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli/index.jsView on unpkg · L6

dist/agent-evals.jsView file

20712try { L20713: new Function(`return (async () => { L20714: ${withoutImports}

High

Eval

Package source references dynamic code evaluation.

dist/agent-evals.jsView on unpkg · L20712

Findings

2 Critical6 High3 Medium5 Low

CriticalCredential Exfiltrationdist/cli/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.js

HighChild Processdist/cli/index.js

HighEvaldist/agent-evals.js

HighCredential Redirect Persistencedist/cli/index.js

HighSandbox Evasion Gated Capabilitydist/cli/index.js

HighCross File Remote Execution Contextdist/cli/index.js

HighTrigger Reachable Credential Exfiltrationdist/cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @granular-software/sdk@0.4.68.

See version security history for other recorded verdicts.

Avoid installing @granular-software/sdk@0.4.68. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-13 11:20:56.518Z (UTC).