@hs-x/cli@0.4.5
HS-X CLI — init, validate, connect, dev, deploy, promote, rollback, doctor, sync. Installs the `hs-x` command.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential uses are tied to user-run deploy or remote invocation commands and go to the credentials' intended services. CLI telemetry is limited to command and runtime metadata, disclosed, and has documented opt-outs.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Telemetry runs when a CLI command completes unless opted out. Deploy events follow a successful mutating deploy; Cloudflare credential requests occur during remote dev invocation.
Impact
The reviewed behavior does not show credentials or project contents being sent to an unrelated host or actions occurring without a user command.
Mechanism
Telemetry sends command and runtime metadata to the HS-X control plane. A successful deploy sends deploy metadata authenticated with the locally generated machine secret to that control plane. Remote invocation uses the Cloudflare token with Cloudflare's API.
AI rationale
The flagged credential uses are tied to user-run deploy or remote invocation commands and go to the credentials' intended services. CLI telemetry is limited to command and runtime metadata, disclosed, and has documented opt-outs.
Network endpoints2
api.hs-x.devapi.cloudflare.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has no install lifecycle hooks; its declared scripts are build and clean.
- CLI telemetry reports command/runtime metadata, is disclosed to users, and can be disabled with documented opt-outs.
- The deploy event is sent only after a successful Cloudflare deploy and contains deploy metadata, not project files or unrelated credentials.
- The machine secret authenticates an event to the package's control plane; it is used for a deploy event after a mutating deploy.
- Remote dev invocation sends a Cloudflare API token to Cloudflare's own API to look up the worker subdomain.
Evidence against
- The scanner flagged credential flows and a changed auth file, but the reviewed flows match the CLI's deploy and remote invocation functions. No unrelated credential collector or hidden automatic action was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
6 flaggeddist/dev/compat-shim.jsView file
71const loggerMod = await import('@hubspot/local-dev-lib/logger');
L72: const importRuntime = new Function('specifier', 'return import(specifier)');
L73: const parsing = await importRuntime('@hubspot/project-parsing-lib/translate');
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/dev/compat-shim.jsView on unpkg · L71dist/dev/invoke.jsView file
174try {
L175: mod = (await import(pathToFileURL(path).href));
L176: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/dev/invoke.jsView on unpkg · L174dist/commands/deploy.jsView file
1import { spawn } from 'node:child_process';
L2: import { createHash, randomBytes } from 'node:crypto';
L3: import { lstat, mkdir, readFile, readdir, realpath, rename, rmdir, stat, unlink, writeFile, } from 'node:fs/promises';
L4: import { createServer } from 'node:http';
L5: import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
...
L61: const explicitFlag = resolveFlag(input.argv, '--account-id');
L62: const fromFlag = explicitFlag ?? process.env.HSX_ACCOUNT_ID;
L63: if (fromFlag && fromFlag.length > 0) {
...
L141: }
L142: return { exitCode: 10 };
L143: }
...
L241: headers: { 'content-type': 'application/x-www-form-urlencoded' },
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/hubspot-auth.js
HighCredential Exfiltrationdist/commands/deploy.js
HighTrigger Reachable Credential Exfiltrationdist/commands/deploy.js
HighSemantic Analysis Limiteddist/commands/doctor.js#virtual:normalized:round1
MediumDynamic Requiredist/dev/invoke.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/dev/compat-shim.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hs-x/cli@0.4.5.
See all versions of @hs-x/cli for other recorded verdicts.
- Review the evidence and your use of @hs-x/cli@0.4.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.