registry / @lightdash/cli / 2.415.5

@lightdash/cli@2.415.5

⚠ Under review

Lightdash CLI tool

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 20 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 131 file(s), 980 KB of source, external domains: 127.0.0.1, analytics.lightdash.com, api.github.com, app.lightdash.cloud, custom.domain.com, custom.lightdash.domain, docs.getdbt.com, docs.lightdash.com, eu1.lightdash.cloud, github.com, lightdash.domain.com, raw.githubusercontent.com

Source & flagged code

13 flagged

package.jsonView file

Lines 66-90json

66 "oxlint-tsgolint": "7.0.2001",

67 "tsx": "4.19.4",

68 "typescript": "7.0.2",

69 "vitest": "4.1.11"

70 },

71 "scripts": {

72 "test": "vitest run --config vitest.config.ts",

73 "test:dev": "vitest watch --config vitest.config.ts --changed",

74 "dev": "tsx src/index.ts",

75 "build": "tsc --build tsconfig.build.json",

76 "postbuild": "copyfiles --all -u 5 \"../../sandboxes/data-apps/template/**/*\" dist/vendor/template && copyfiles --all -u 4 \"src/handlers/apps/authoring/**/*\" dist/vendor/authoring",

77 "bundle": "ncc build dist/index.js -o bundle -e @duckdb/node-api -e @duckdb/node-bindings -e @duckdb/node-bindings-darwin-arm64 -e @duckdb/node-bindings-darwin-x64 -e @duckdb/node-bindings-linux-arm64 -e @duckdb/node-bindings-linux-x64 -e @duckdb/node-bindings-win32-x64 && bash ./scripts/copy-bundle-assets.sh",

78 "build:binary": "DUCKDB_BINDINGS=node-bindings-darwin-x64,node-bindings-darwin-arm64 pnpm bundle && pnpm exec pkg bundle/index.js --config pkg.config.json --targets node24-macos-x64,node24-macos-arm64 --output bin/lightdash --compress Brotli",

79 "typecheck": "tsc --project tsconfig.json --noEmit",

80 "linter": "oxlint -c .oxlintrc.json --ignore-path ./../../.gitignore",

81 "formatter": "oxfmt",

82 "lint": "pnpm run linter ./src",

83 "fix-lint": "pnpm run linter ./src --fix",

84 "format": "oxfmt ./src --check",

85 "fix-format": "oxfmt ./src",

86 "preinstall": "bash track.sh started || echo 'skipping preinstall'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L86

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L86

87 "postinstall": "bash track.sh completed || echo 'skipping postinstall'",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L87

88 "release": "pnpm publish --no-git-checks --access public"

89 }

90}

dist/dbt/targets/redshift.jsView file

Lines 146-186javascript

146 user: target.user ?? '',

147 port: target.port,

148 dbname,

149 schema: target.schema,

150 keepalivesIdle: target.keepalives_idle,

151 sslmode

dist/dbt/schema.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.searchForModel = void 0;

4const common_1 =

dist/vendor/template/scripts/bootstrap.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 708 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/vendor/template/scripts/bootstrap.shView on unpkg

dist/handlers/apps/pathContainment.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/handlers/apps/pathContainment.js#virtual:normalized:round1View on unpkg

dist/handlers/apps/preview.jsView file

•matchType = normalized_sha256 matchedPackage = @lightdash/cli@2.250.1 matchedPath = dist/handlers/apps/preview.js matchedIdentity = npm:QGxpZ2h0ZGFzaC9jbGk:2.250.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/apps/preview.jsView on unpkg

dist/dbt/manifest.jsView file

•matchType = normalized_sha256 matchedPackage = @lightdash/cli@2.250.1 matchedPath = dist/dbt/manifest.js matchedIdentity = npm:QGxpZ2h0ZGFzaC9jbGk:2.250.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dbt/manifest.jsView on unpkg

dist/handlers/installSkills.jsView file

•matchType = normalized_sha256 matchedPackage = @lightdash/cli@2.250.1 matchedPath = dist/handlers/installSkills.js matchedIdentity = npm:QGxpZ2h0ZGFzaC9jbGk:2.250.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/installSkills.jsView on unpkg

dist/handlers/slugUpdate.jsView file

•matchType = normalized_sha256 matchedPackage = @lightdash/cli@2.250.1 matchedPath = dist/handlers/slugUpdate.js matchedIdentity = npm:QGxpZ2h0ZGFzaC9jbGk:2.250.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/slugUpdate.jsView on unpkg

dist/handlers/download.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lightdash/cli@2.269.0 matchedIdentity = npm:QGxpZ2h0ZGFzaC9jbGk:2.269.0 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/handlers/download.jsView on unpkg

dist/dbt/targets/postgres.jsView file

Lines 99-139javascript

99 let sslkeyFile;

100 let sslrootcertFile;

101 if (target.sslmode === 'verify-full') {

102 if (!target.sslcert || !target.sslkey ||

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.preinstall = bash track.sh started || echo 'skipping preinstall'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = bash track.sh started || echo 'skipping preinstall'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = bash track.sh completed || echo 'skipping postinstall'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/dbt/targets/redshift.jsView file

166patternName = generic_password severity = medium line = 166

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dbt/targets/redshift.jsView on unpkg · L166

dist/dbt/schema.jsView file

3package = @lightdash/cli; repositoryIdentity = lightdash; dependency = @lightdash/common L3: exports.searchForModel = void 0; L4: const common_1 = require("@lightdash/common"); L5: const fs_1 = require("fs");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/dbt/schema.jsView on unpkg · L3

dist/vendor/template/scripts/bootstrap.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 708 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/vendor/template/scripts/bootstrap.shView on unpkg

dist/handlers/apps/pathContainment.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/handlers/apps/pathContainment.js#virtual:normalized:round1View on unpkg

dist/handlers/apps/preview.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/apps/preview.jsView on unpkg

dist/dbt/manifest.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dbt/manifest.jsView on unpkg

dist/handlers/installSkills.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/installSkills.jsView on unpkg

dist/handlers/slugUpdate.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/slugUpdate.jsView on unpkg

dist/handlers/download.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/handlers/download.jsView on unpkg

dist/dbt/targets/postgres.jsView file

119patternName = generic_password severity = medium line = 119

Medium

Secret Pattern

Hardcoded password in dist/dbt/targets/postgres.js

dist/dbt/targets/postgres.jsView on unpkg · L119

Findings

8 High8 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgedist/dbt/schema.js

HighSemantic Analysis Limiteddist/handlers/apps/pathContainment.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/handlers/apps/preview.js

HighKnown Malware Source Similaritydist/dbt/manifest.js

HighKnown Malware Source Similaritydist/handlers/installSkills.js

HighKnown Malware Source Similaritydist/handlers/slugUpdate.js

HighPrevious Version Dangerous Deltadist/handlers/download.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/dbt/targets/redshift.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/vendor/template/scripts/bootstrap.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/dbt/targets/postgres.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @lightdash/cli@2.415.5.

See version security history for other recorded verdicts.

Review the evidence and your use of @lightdash/cli@2.415.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-02 12:26:06.634Z (UTC).