@limai.io/cli@0.4.5
CLI and SDK for the LimAI data extraction platform
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe SDK automatically forwards VERCEL_BYPASS to its configured LimAI API endpoint on requests, exposing a deployment bypass credential without checking that it belongs to that service. This is credential exfiltration under the package firewall rules.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An SDK or CLI operation that makes an API request while VERCEL_BYPASS is set.
Impact
The API recipient may gain a Vercel deployment-protection bypass credential unrelated to the LimAI API account token.
Mechanism
The HTTP client adds the environment value as x-vercel-protection-bypass to requests sent to apiUrl.
Attack narrative
When a normal API request is made, the SDK reads VERCEL_BYPASS from the environment and sends it in a Vercel protection-bypass header to the configured LimAI API URL. The package gives no consent prompt or check that the value belongs to that endpoint, exposing a credential for another service.
AI rationale
The SDK automatically forwards VERCEL_BYPASS to its configured LimAI API endpoint on requests, exposing a deployment bypass credential without checking that it belongs to that service. This is credential exfiltration under the package firewall rules.
Evidence
dist/index.js
Network endpoints1
Configured LIMAI API URL (LIMAI_API_URL or saved apiUrl), path /api/v1${apiPath}
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- The SDK builds API requests against the supplied apiUrl, using /api/v1 paths.
- Its authHeaders method reads VERCEL_BYPASS and copies it into the x-vercel-protection-bypass header.
- Requests use the constructed API URL and the SDK's auth headers; apiUrl can come from LIMAI_API_URL or saved configuration.
- The only lifecycle script is prepublishOnly, which runs the build.
Evidence against
- The manifest describes a LimAI CLI and SDK, with dist/index.js as the library entry point.
- Vercel bypass headers can be relevant when the configured API is behind Vercel, but the source does not establish that this credential belongs to the LimAI API.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/index.jsView file
1"use strict";var _e=Object.create;var ot=Object.defineProperty;var Le=Object.getOwnPropertyDescriptor;var Ne=Object.getOwnPropertyNames;var Me=Object.getPrototypeOf,Fe=Object.proto...
L2: `)===-1&&l.indexOf("\r")===-1){i.push(l);return}i.push(l);let o=i.join("");i.length=0;let d=m(o);d!==""&&i.push(d)}function m(l){let o=0;if(l.indexOf("\r")===-1){let d=l.indexOf(`
High
1"use strict";var _e=Object.create;var ot=Object.defineProperty;var Le=Object.getOwnPropertyDescriptor;var Ne=Object.getOwnPropertyNames;var Me=Object.getPrototypeOf,Fe=Object.proto...
L2: `)===-1&&l.indexOf("\r")===-1){i.push(l);return}i.push(l);let o=i.join("");i.length=0;let d=m(o);d!==""&&i.push(d)}function m(l){let o=0;if(l.indexOf("\r")===-1){let d=l.indexOf(`
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L11Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js
L1: "use strict";var _e=Object.create;var ot=Object.defineProperty;var Le=Object.getOwnPropertyDescriptor;var Ne=Object.getOwnPropertyNames;var Me=Object.getPrototypeOf,Fe=Object.proto...
L2: `)===-1&&l.indexOf("\r")===-1){i.push(l);return}i.push(l);let o=i.join("");i.length=0;let d=m(o);d!==""&&i.push(d)}function m(l){let o=0;if(l.indexOf("\r")===-1){let d=l.indexOf(`
Findings
2 Critical4 High3 Medium6 Low
CriticalSame File Env Network Executiondist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighRuntime Package Installdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @limai.io/cli@0.4.5.
See all versions of @limai.io/cli for other recorded verdicts.
- Avoid installing @limai.io/cli@0.4.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.