registry / @imagifly/cli / 0.1.5
@imagifly/cli@0.1.5
Agent-first CLI for the Imagifly image and video API
AI Security Review
scanned 18h ago · by lpm-firewall-aiThe flagged auth behavior is tied to an explicit login flow: it opens the browser for user approval, exchanges the returned code with the configured Imagifly service, and stores supplied keys locally. The package has no install hook, and review found no automatic credential collection or unrelated network destination.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the CLI, and authentication or API actions require an explicit command.
Impact
Expected CLI use stores credentials locally and sends service requests to Imagifly.
Mechanism
OAuth exchanges a user-approved authorization code with the Imagifly service. API keys are saved to the CLI config file.
AI rationale
The flagged auth behavior is tied to an explicit login flow: it opens the browser for user approval, exchanges the returned code with the configured Imagifly service, and stores supplied keys locally. The package has no install hook, and review found no automatic credential collection or unrelated network destination.
Evidence
~/.config/imagifly/config.json
Network endpoints2
imagifly.net127.0.0.1
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which builds the package; there is no install hook.
- The CLI invokes its main function when the executable runs, and OAuth login is an explicit command that asks the user to click Allow.
- OAuth exchanges the returned authorization code with the configured Imagifly service; a supplied API key is saved to the config file.
- The default API host is imagifly.net, and the skill says not to send a hostname.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/commands/auth.jsView file
2import { createServer } from "node:http";
L3: import { spawn } from "node:child_process";
L4: import { stdin as input } from "node:process";
High
Child Process
Package source references child process execution.
dist/commands/auth.jsView on unpkg · L21import { createHash, randomBytes } from "node:crypto";
L2: import { createServer } from "node:http";
L3: import { spawn } from "node:child_process";
L4: import { stdin as input } from "node:process";
...
L16: }
L17: if (!input.isTTY && !process.env.IMAGIFLY_ALLOW_DEVICE_LOGIN) {
L18: throw badArgs("Run `imagifly auth login` in a terminal, or pass --key only for CI.");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/commands/auth.jsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = @imagifly/cli@0.1.3
matchedIdentity = npm:QGltYWdpZmx5L2NsaQ:0.1.3
similarity = 0.917
summary = stored previous version shares package body but lacks this dangerous source file
High
Findings
3 High2 Medium7 Low
HighChild Processdist/commands/auth.js
HighSame File Env Network Executiondist/commands/auth.js
HighPrevious Version Dangerous Deltadist/commands/auth.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/cli.js
Affected versions and remediation
This report applies to @imagifly/cli@0.1.5.
See all versions of @imagifly/cli for other recorded verdicts.
- Review the evidence and your use of @imagifly/cli@0.1.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.