registry / @newly/cli / 0.1.1

@newly/cli@0.1.1

Develop, provision, and deploy Newly backends from your terminal

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Network, file, and process actions are explicit Newly CLI operations: authentication, project transfer, deployment, and browser launch.

Static reason

No blocking static signals were detected.

Trigger

User runs a newly command such as login, pull, deploy, or website publish.

Impact

May store Newly credentials and upload/download the selected project as requested; no unconsented install-time action found.

Mechanism

Authenticated API client and user-invoked local project packaging.

Rationale

The flagged primitives implement documented, user-invoked CLI functionality. Source inspection found no install-time execution, covert collection/exfiltration, remote payload execution, persistence, or AI-agent control-surface mutation.

Evidence

package.jsondist/index.jsdist/commands/login.jsdist/config.jsdist/api.jsdist/archive.jsdist/commands/deploy.jsdist/commands/pull.jsdist/commands/website.js~/.newly/credentials~/.newly-dev/credentials.newly/project.json

Network endpoints1

newly.app

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install lifecycle hook; prepublishOnly is publisher-side.
dist/index.js only registers user-invoked CLI commands.
dist/commands/login.js opens the declared login URL and binds callback only to 127.0.0.1.
dist/config.js stores the supplied login token locally with mode 0600.
dist/archive.js excludes common secret files from deployment snapshots.
No eval, shell execution, remote code loading, or AI-agent configuration writes found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 22 file(s), 81.0 KB of source, external domains: newly.app

Source & flagged code

2 flagged

dist/commands/login.jsView file

Lines 1-22javascript

1import http from 'node:http';

2import crypto from 'node:crypto';

3import { spawn } from 'node:child_process';

4import { clearCredentials, saveCredentials } from '../config.js';

High

Child Process

Package source references child process execution.

dist/commands/login.jsView on unpkg · L2

5const DEFAULT_APP_URL = process.env.NEWLY_APP_URL ?? 'https://newly.app';

6const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/login.jsView on unpkg · L1

7export async function startCallbackServer(state, appOrigin, timeoutMs) {

8 let resolvePayload;

9 let rejectPayload;

10 const payloadPromise = new Promise((resolve, reject) => {

11 resolvePayload = resolve;

12 rejectPayload = reject;

13 });

14 const timer = setTimeout(() => rejectPayload(new Error(`Login timed out after ${timeoutMs / 1000}s`)), timeoutMs);

15 const corsHeaders = {

16 'Access-Control-Allow-Origin': appOrigin,

17 'Access-Control-Allow-Methods': 'POST, OPTIONS',

18 'Access-Control-Allow-Headers': 'content-type',

19 };

20 const server = http.createServer((req, res) => {

21 if (req.method === 'OPTIONS') {

22 res.writeHead(204, corsHeaders);

Source & flagged code

2 flagged · loading source

dist/commands/login.jsView file

2import crypto from 'node:crypto'; L3: import { spawn } from 'node:child_process'; L4: import { clearCredentials, saveCredentials } from '../config.js';

High

Child Process

Package source references child process execution.

dist/commands/login.jsView on unpkg · L2

1import http from 'node:http'; L2: import crypto from 'node:crypto'; L3: import { spawn } from 'node:child_process'; L4: import { clearCredentials, saveCredentials } from '../config.js'; L5: const DEFAULT_APP_URL = process.env.NEWLY_APP_URL ?? 'https://newly.app'; L6: const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/login.jsView on unpkg · L1

Findings

3 High2 Medium6 Low

HighChild Processdist/commands/login.js

HighShell

HighSame File Env Network Executiondist/commands/login.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License