registry / @hypequery/cli / 1.25.0
@hypequery/cli@1.25.0
CLI for scaffolding type-safe ClickHouse analytics, semantic datasets, React manifests, and deployments
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection resolves the main static alerts as CLI project setup, project package loading, and bounded first-party telemetry. No concrete malicious behavior was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI command such as project initialization or development mode.
Impact
No confirmed attack surface was established; the inspected behavior supports the CLI’s stated setup and development functions.
Mechanism
Initialization may add missing HypeQuery scaffold dependencies; development mode loads the project API and server package. Telemetry uses a configured HTTPS endpoint and bounded CLI metrics.
AI rationale
Source inspection resolves the main static alerts as CLI project setup, project package loading, and bounded first-party telemetry. No concrete malicious behavior was established.
Network endpoints1
hypequery.com/api/telemetry
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies a CLI with a command entry point and no install lifecycle hook.
- The scaffold installer runs when invoked by the CLI, skips when configured, checks for missing scaffold packages, and invokes the selected package manager to add them.
- The dev command loads the server package to start the requested development server; the project-root helper resolves the user project’s installed package.
- Telemetry uses the HypeQuery endpoint by default, permits an environment override, and rejects non-HTTPS destinations except loopback. The reviewed telemetry catalog describes bounded CLI metrics.
Evidence against
- Static alerts for dynamic loading, network use, environment variables, and the scaffold installer are consistent with the CLI’s project-loading, telemetry, and setup functions; inspected source did not establish an attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggeddist/commands/init.jsView file
360patternName = generic_password
severity = medium
line = 360
Medium
dist/utils/project-root.jsView file
34try {
L35: resolved = createRequire(path.resolve(fromFile)).resolve(specifier);
L36: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/utils/project-root.jsView on unpkg · L34dist/commands/dev.jsView file
128package = @hypequery/cli; repositoryIdentity = hypequery; dependency = open
L128: try {
L129: const open = (await import('open')).default;
L130: await open(baseUrl);
Findings
2 High5 Medium5 Low
HighCopied Package Dependency Bridgedist/commands/dev.js
HighPrevious Version Dangerous Deltadist/utils/dependency-installer.js
MediumSecret Patterndist/commands/init.js
MediumDynamic Requiredist/utils/project-root.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @hypequery/cli@1.25.0.
See all versions of @hypequery/cli for other recorded verdicts.
- Review the evidence and your use of @hypequery/cli@1.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.