registry / @imagifly/cli / 0.1.3
@imagifly/cli@0.1.3
Agent-first CLI for the Imagifly image and video API
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package exposes an Imagifly API CLI with no install hook; its flagged process execution opens the OAuth URL only during a user-run login command. Credentials are used for requests to the configured API base, and no unrelated collection or automatic account action was found.
Static reason
No blocking static signals were detected.
Trigger
Users run the imagifly command and explicitly choose login, API, or media download commands.
Impact
No unrelated collection, unauthorized account action, or concealed execution was found. User-requested login stores credentials, and media output is saved to the chosen destination.
Mechanism
OAuth uses a loopback callback and opens the authorization URL during login; API calls send the selected Imagifly credential to the configured API base.
AI rationale
The package exposes an Imagifly API CLI with no install hook; its flagged process execution opens the OAuth URL only during a user-run login command. Credentials are used for requests to the configured API base, and no unrelated collection or automatic account action was found.
Evidence
~/.config/imagifly/config.jsonuser-selected media output path
Network endpoints2
imagifly.net/api/v1127.0.0.1:<dynamic-port>/callback
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which runs the build; no install hook is declared.
- The bin entry runs the CLI command parser, and auth/browser actions are reached through explicit commands.
- Browser process execution opens the OAuth URL during login; it does not run an embedded shell payload.
- API credentials are sent as Bearer authorization to the configured Imagifly API base, which defaults to https://imagifly.net/api/v1.
Evidence against
- The flagged auth file combines environment access, network calls, and child_process usage, but the inspected code ties them to the documented login/API flow.
- The package has network and filesystem access for its image/video API features and saving user-requested credentials or media.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/commands/auth.jsView file
2import { createServer } from "node:http";
L3: import { spawn } from "node:child_process";
L4: import { stdin as input } from "node:process";
High
Child Process
Package source references child process execution.
dist/commands/auth.jsView on unpkg · L21import { createHash, randomBytes } from "node:crypto";
L2: import { createServer } from "node:http";
L3: import { spawn } from "node:child_process";
L4: import { stdin as input } from "node:process";
...
L16: }
L17: if (!input.isTTY && !process.env.IMAGIFLY_ALLOW_DEVICE_LOGIN) {
L18: throw badArgs("Run `imagifly auth login` in a terminal, or pass --key only for CI.");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/commands/auth.jsView on unpkg · L1208function openBrowser(url) {
try {
const command = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
co
Low
Findings
2 High2 Medium8 Low
HighChild Processdist/commands/auth.js
HighSame File Env Network Executiondist/commands/auth.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/cli.js
LowAi Review Evidencedist/commands/auth.js
Affected versions and remediation
This report applies to @imagifly/cli@0.1.3.
See all versions of @imagifly/cli for other recorded verdicts.
- Review the evidence and your use of @imagifly/cli@0.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.