Loading npm security reports…

@lightdash/cli@0.3411.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @lightdash/cli / 0.3411.0

@lightdash/cli@0.3411.0

Lightdash CLI tool

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 133 file(s), 844 KB of source, external domains: analytics.lightdash.com, api.github.com, app.lightdash.cloud, bucket.s3.amazonaws.com, custom.domain.com, custom.lightdash.domain, docs.getdbt.com, docs.lightdash.com, eu1.lightdash.cloud, example.com, github.com, lightdash.domain.com, lightdash.example.com, raw.githubusercontent.com

Source & flagged code

9 flagged

package.jsonView file

Lines 60-84json

60 "typescript-7": "npm:typescript@7.0.1-rc",

61 "vitest": "4.1.6"

62 },

63 "scripts": {

64 "test": "vitest run --config vitest.config.ts",

65 "test:dev": "vitest watch --config vitest.config.ts --changed",

66 "dev": "tsx src/index.ts",

67 "build": "tsc6 --build tsconfig.json",

68 "postbuild": "copyfiles --all -u 5 \"../../sandboxes/data-apps/template/**/*\" dist/vendor/template && copyfiles --all -u 4 \"src/handlers/apps/authoring/**/*\" dist/vendor/authoring",

69 "build:fast": "tsc --build tsconfig.fast.json",

70 "bundle": "ncc build dist/index.js -o bundle -e @duckdb/node-api -e @duckdb/node-bindings -e @duckdb/node-bindings-darwin-arm64 -e @duckdb/node-bindings-darwin-x64 -e @duckdb/node-bindings-linux-arm64 -e @duckdb/node-bindings-linux-x64 -e @duckdb/node-bindings-win32-x64 && bash ./scripts/copy-bundle-assets.sh",

71 "build:binary": "DUCKDB_BINDINGS=node-bindings-darwin-x64,node-bindings-darwin-arm64 pnpm bundle && npx @yao-pkg/pkg bundle/index.js --config pkg.config.json --targets node20-macos-x64,node20-macos-arm64 --output bin/lightdash --compress Brotli",

72 "typecheck": "tsc6 --project tsconfig.json --noEmit",

73 "typecheck:fast": "tsc --project tsconfig.fast.json --noEmit",

74 "linter": "eslint -c .eslintrc.js --ignore-path ./../../.gitignore",

75 "formatter": "oxfmt",

76 "lint": "pnpm run linter ./src",

77 "fix-lint": "pnpm run linter ./src --fix",

78 "format": "oxfmt ./src --check",

79 "fix-format": "oxfmt ./src",

80 "preinstall": "bash track.sh started || echo 'skipping preinstall'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L80

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L80

81 "postinstall": "bash track.sh completed || echo 'skipping postinstall'",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L81

82 "release": "pnpm publish --no-git-checks --access public"

83 }

84}

dist/dbt/targets/redshift.jsView file

Lines 146-186javascript

146 user: target.user ?? '',

147 port: target.port,

148 dbname,

149 schema: target.schema,

150 keepalivesIdle: target.keepalives_idle,

151 sslmode

dist/dbt/schema.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.searchForModel = void 0;

4const common_1 =

dist/vendor/template/scripts/bootstrap.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 554 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/vendor/template/scripts/bootstrap.shView on unpkg

dist/dbt/targets/postgres.jsView file

Lines 99-139javascript

99 let sslkeyFile;

100 let sslrootcertFile;

101 if (target.sslmode === 'verify-full') {

102 if (!target.sslcert || !target.sslkey ||

dist/handlers/connectSnowflake.test.jsView file

Lines 58-98javascript

58 name: 'analytics',

59 comment: 'Analytics data',

60 kind: 'STANDARD',

61 },

62 ],

63 warehouses: [

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = bash track.sh started || echo 'skipping preinstall'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = bash track.sh started || echo 'skipping preinstall'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = bash track.sh completed || echo 'skipping postinstall'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/dbt/targets/redshift.jsView file

Findings

1 Critical2 High9 Medium4 Low

CriticalSecret Patterndist/handlers/connectSnowflake.test.js

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgedist/dbt/schema.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/dbt/targets/redshift.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/vendor/template/scripts/bootstrap.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/dbt/targets/postgres.js

MediumSecret Patterndist/handlers/connectSnowflake.test.js

Source & flagged code

9 flagged

package.jsonView file

Lines 60-84json

60 "typescript-7": "npm:typescript@7.0.1-rc",

61 "vitest": "4.1.6"

62 },

63 "scripts": {

64 "test": "vitest run --config vitest.config.ts",

65 "test:dev": "vitest watch --config vitest.config.ts --changed",

66 "dev": "tsx src/index.ts",

67 "build": "tsc6 --build tsconfig.json",

68 "postbuild": "copyfiles --all -u 5 \"../../sandboxes/data-apps/template/**/*\" dist/vendor/template && copyfiles --all -u 4 \"src/handlers/apps/authoring/**/*\" dist/vendor/authoring",

69 "build:fast": "tsc --build tsconfig.fast.json",

72 "typecheck": "tsc6 --project tsconfig.json --noEmit",

73 "typecheck:fast": "tsc --project tsconfig.fast.json --noEmit",

74 "linter": "eslint -c .eslintrc.js --ignore-path ./../../.gitignore",

75 "formatter": "oxfmt",

76 "lint": "pnpm run linter ./src",

77 "fix-lint": "pnpm run linter ./src --fix",

78 "format": "oxfmt ./src --check",

79 "fix-format": "oxfmt ./src",

80 "preinstall": "bash track.sh started || echo 'skipping preinstall'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L80

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L80

81 "postinstall": "bash track.sh completed || echo 'skipping postinstall'",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L81

82 "release": "pnpm publish --no-git-checks --access public"

83 }

84}

dist/dbt/targets/redshift.jsView file

Lines 146-186javascript

146 user: target.user ?? '',

147 port: target.port,

148 dbname,

149 schema: target.schema,

150 keepalivesIdle: target.keepalives_idle,

151 sslmode

dist/dbt/schema.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.searchForModel = void 0;

4const common_1 =

dist/vendor/template/scripts/bootstrap.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 554 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/vendor/template/scripts/bootstrap.shView on unpkg

dist/dbt/targets/postgres.jsView file

Lines 99-139javascript

99 let sslkeyFile;

100 let sslrootcertFile;

101 if (target.sslmode === 'verify-full') {

102 if (!target.sslcert || !target.sslkey ||

dist/handlers/connectSnowflake.test.jsView file

Lines 58-98javascript

58 name: 'analytics',

59 comment: 'Analytics data',

60 kind: 'STANDARD',

61 },

62 ],

63 warehouses: [

Lines 282-322javascript

282 });

283 it('uses a unique PAT name when both key slots are occupied', async () => {

284 vi.mocked(getUserPublicKeySlots).mockResolvedValue({

285 RSA_PUBLIC_KEY: 'SHA256:existing-key-1',

286 RSA_PUBLIC_KEY_2: 'SHA256:existing-key-2',

287 });

288 await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).resolves.toBeUndefined();

289 expect(setUserPublicKey).not.toHaveBeenCalled();

290 expect(createProgrammaticAccessToken).toHaveBeenCalledWith(expect.stringMatching(/^LIGHTDASH_ONBOARDING_\d+$/), 365, 1440);

291 const request = {

292 code: options.code,

293 credentials: {

294 type: common_1.WarehouseTypes.SNOWFLAKE,

295 account: options.account,

296 user: discovery.user,

297 authenticationType: common_1.SnowflakeAuthenticationType.PASSWORD,

298 role: discovery.defaults.role ?? undefined,

299 database: discovery.defaults.database ?? '',

300 warehouse: discovery.defaults.warehouse ?? '',

301 schema: discovery.defaults.schema ?? '',

302 password: 'pat-secret',

Medium

Secret Pattern

Hardcoded password in dist/handlers/connectSnowflake.test.js

dist/handlers/connectSnowflake.test.jsView on unpkg · L302

303 },

304 inventory: depositInventory,

305 };

306 expect(getDepositRequest()).toEqual(request);

307 });

308 it('unsets an unverified key before falling back to a PAT', async () => {

309 vi.mocked(openDiagnosticConnection).mockRejectedValue(new Error('Authentication policy excludes KEYPAIR'));

310 await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).resolves.toBeUndefined();

311 expect(openDiagnosticConnection).toHaveBeenCalledTimes(3);

312 expect(sleep).toHaveBeenCalledTimes(2);

313 expect(sleep).toHaveBeenCalledWith(5_000);

314 expect(unsetUserPublicKey).toHaveBeenCalledWith(discovery.user, 'RSA_PUBLIC_KEY');

315 expect(createProgrammaticAccessToken).toHaveBeenCalledAfter(unsetUserPublicKey);

316 });

317 it('falls back to a PAT when key registration lacks privileges', async () => {

318 vi.mocked(setUserPublicKey).mockRejectedValue(new Error('Insufficient privileges to operate on user'));

319 await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).resolves.toBeUndefined();

320 expect(createProgrammaticAccessToken).toHaveBeenCalledWith(expect.stringMatching(/^LIGHTDASH_ONBOARDING_\d+$/), 365, 1440);

321 expect(write).toHaveBeenCalledWith('Secured with a programmatic access token (expires 2027-07-14)');

322 });