registry / @hypequery/cli / 1.23.0
@hypequery/cli@1.23.0
CLI for scaffolding type-safe ClickHouse analytics, semantic datasets, React manifests, and deployments
AI Security Review
scanned 23d ago · by lpm-firewall-aiInspected source shows no install lifecycle hook or malicious runtime behavior. The flagged network and dynamic-loading behavior is reached through explicit CLI functions and follows configured destinations.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes login, logout, a deployment command, or dev.
Impact
No unintended credential disclosure, install-time mutation, or other malicious effect was identified.
Mechanism
Login and logout use the configured Cloud origin and saved credential origin; live-deployment requests validate their destination, while telemetry requires a configured telemetry URL or debug setting.
AI rationale
Inspected source shows no install lifecycle hook or malicious runtime behavior. The flagged network and dynamic-loading behavior is reached through explicit CLI functions and follows configured destinations.
Evidence
package.jsondist/commands/login.jsdist/utils/live-deployment.jsdist/cli.jsdist/commands/dev.jsdist/utils/telemetry/environment.js
Network endpoints1
cloud.hypequery.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines the CLI entrypoint and lists build, development, lint, test, and documentation scripts, with no install lifecycle hook.
- The explicit login flow posts an authorization code to its configured Cloud origin; logout revokes the saved token at the origin stored with that credential.
- Live-deployment requests send a bearer token to a validated deployment URL restricted to HTTPS or loopback HTTP.
- The CLI wires login, logout, and pull to explicit commands; the dev command loads the selected project API when invoked.
- Telemetry collection is gated on a configured telemetry URL or debug setting, and the inspected environment code validates collected properties.
- Project dependency resolution imports the requested project package, and the dev command loads the requested serve package.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggeddist/commands/init.jsView file
360patternName = generic_password
severity = medium
line = 360
Medium
dist/utils/project-root.jsView file
34try {
L35: resolved = createRequire(path.resolve(fromFile)).resolve(specifier);
L36: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/utils/project-root.jsView on unpkg · L34dist/commands/dev.jsView file
125package = @hypequery/cli; repositoryIdentity = hypequery; dependency = open
L125: try {
L126: const open = (await import('open')).default;
L127: await open(baseUrl);
Findings
2 High5 Medium5 Low
HighCopied Package Dependency Bridgedist/commands/dev.js
HighPrevious Version Dangerous Deltadist/utils/telemetry/environment.js
MediumSecret Patterndist/commands/init.js
MediumDynamic Requiredist/utils/project-root.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @hypequery/cli@1.23.0.
See all versions of @hypequery/cli for other recorded verdicts.
- Review the evidence and your use of @hypequery/cli@1.23.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.