@hypequery/cli@1.18.0
CLI for scaffolding type-safe ClickHouse analytics, semantic datasets, React manifests, and deployments
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe deployment flow can forward HYPEQUERY_API_TOKEN to an unrestricted, operator-configured HTTPS endpoint. This is a conditional credential exposure risk, so it warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs a deployment command with both an explicit endpoint and HYPEQUERY_API_TOKEN configured.
Impact
A token sent to an untrusted endpoint could be disclosed to that endpoint.
Mechanism
The CLI uses the selected endpoint for the upload and places the token in the request Authorization header; HTTPS is required except for loopback development.
AI rationale
The deployment flow can forward HYPEQUERY_API_TOKEN to an unrestricted, operator-configured HTTPS endpoint. This is a conditional credential exposure risk, so it warrants a warning rather than a block.
Evidence
dist/utils/cloud-deployment-access.jsdist/utils/deployment-upload.jsdist/cli.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The deployment command accepts an operator-configured endpoint and pairs it with HYPEQUERY_API_TOKEN.
- The upload transport sends that token as a bearer credential to the selected endpoint.
- The transport permits HTTPS endpoints without restricting them to a Hypequery host.
Evidence against
- The endpoint and token must both be explicitly supplied for this configuration path; the inspected code does not show a hidden default recipient.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/commands/init.jsView file
343patternName = generic_password
severity = medium
line = 343
Medium
dist/utils/load-api.jsView file
79? await importOverride(moduleUrl)
L80: : await import(/* @vite-ignore */ moduleUrl);
L81: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/utils/load-api.jsView on unpkg · L79dist/commands/dev.jsView file
117package = @hypequery/cli; repositoryIdentity = hypequery; dependency = open
L117: try {
L118: const open = (await import('open')).default;
L119: await open(baseUrl);
Findings
1 High7 Medium4 Low
HighCopied Package Dependency Bridgedist/commands/dev.js
MediumSecret Patterndist/commands/init.js
MediumDynamic Requiredist/utils/load-api.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/utils/cloud-deployment-access.js
MediumAi Review Evidencedist/utils/deployment-upload.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hypequery/cli@1.18.0.
See all versions of @hypequery/cli for other recorded verdicts.
- Review the evidence and your use of @hypequery/cli@1.18.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.