registry / @iga-pages/cli / 1.1.11
@iga-pages/cli@1.1.11
A CLI tool for IGA Pages
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no lifecycle hook or concrete malicious behavior. The observed network request is a bounded package update check.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the iga CLI or deploys a handler using the runtime.
Impact
No unconsented install-time execution, credential export, persistence, or destructive behavior was identified.
Mechanism
The CLI creates commands and the runtime routes HTTP methods to supplied handlers.
AI rationale
Static inspection found no lifecycle hook or concrete malicious behavior. The observed network request is a bounded package update check.
Network endpoints1
registry.npmjs.org/@iga-pages/cli/latest
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata defines a CLI entrypoint and build/test scripts, with no install lifecycle hook.
- The main bundle initializes the iga command only when invoked.
- The functions runtime dispatches supplied HTTP handlers by request method.
- The only inspected update endpoint is the package's npm registry latest-version URL.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Oversized source lightweight scan
dist/index.js4.43 MB file, sampled 256 KB
Filesystem
Source & flagged code
11 flaggeddist/functions-runtime.jsView file
11357exports1.execCommand = execCommand;
L11358: const child_process_1 = __webpack_require__("child_process");
L11359: function spawnCommand(command, opts = {}) {
High
Child Process
Package source references child process execution.
dist/functions-runtime.jsView on unpkg · L11357dist/index.jsView file
112node_major: process.versions.node.split(".")[0],
L113: os: process.platform,
L114: arch: process.arch,
L115: interaction_mode: command.metadata.interactionMode ?? (true === process.stdin.isTTY && true === process.stdout.isTTY ? "interactive" : "non-interactive"),
L116: invocation_type: context.invocation_type,
...
L390: }
L391: function resolveInvocationContext({ cliName, cliVersion, env = process.env, stdinIsTTY = true === process.stdin.isTTY, stdoutIsTTY = true === process.stdout.isTTY }) {
L392: const skill = normalizeSkillId(env.VE_SKILL_ID);
...
L535: "passwd",
L536: "privatekey",
L537: "secret",
...
L759: const node_crypto_1 = __webpack_require__("node:crypto");
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/index.jsView on unpkg · L112Findings
2 Critical7 High4 Medium5 Low
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/functions-runtime.js
HighEvaldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighCross File Remote Execution Contextdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @iga-pages/cli@1.1.11.
See all versions of @iga-pages/cli for other recorded verdicts.
- Review the evidence and your use of @iga-pages/cli@1.1.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.