registry / @newrelic/preflight / 1.0.7

@newrelic/preflight@1.0.7

New Relic MCP server for observing AI coding assistants (Claude Code, Cursor, Windsurf, Copilot, and more)

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 142 file(s), 2.02 MB of source, external domains: 127.0.0.1, api.eu.newrelic.com, api.newrelic.com, bit.ly, github.com, hooks.slack.com, insights-collector.newrelic.com, newrelic.com, one.newrelic.com, otlp.nr-data.net, react.dev, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, www.apple.com, www.w3.org

Source & flagged code

1 flagged

dist/install/setup-wizard.jsView file

Lines 2-42javascript

2import { mkdirSync, readFileSync, existsSync, copyFileSync, chmodSync, realpathSync, } from 'node:fs';

3import { resolve, dirname } from 'node:path';

4import { normalizeDeveloperName, ConfigFileSchema, DEFAULT_STORAGE_PATH } from '../config.js';

5import { migrateStoragePath } from './migrate.js';

6import { runInstallCli, verifyBinaryOnPath, findRepoRoot } from './cli.js';

7import { writeJsonFile } from './json-utils.js';

8import { installSchedule, installDashboardDaemon, resolveBinaryPath } from './schedule.js';

9import { isWsl, resolveWindowsHome } from './platform.js';

10import { validateLicenseKey, validateApiKey } from './key-validator.js';

11const CONFIG_PATH = resolve(DEFAULT_STORAGE_PATH, 'config.json');

12const ALERT_RULES_DEST = resolve(DEFAULT_STORAGE_PATH, 'alerts', 'rules.json');

13function defaultStarterRulesSource() {

14 const root = findRepoRoot();

15 if (root !== null)

16 return resolve(root, 'examples', 'local-alert-rules.json');

17 // findRepoRoot() failed — fall back to walking two directories up from the

18 // real entry-point path. Resolve symlinks first so a globally-installed binary

19 // (e.g. /usr/local/bin/preflight → .../node_modules/preflight/dist/index.js)

20 // correctly walks up to the package root rather than /usr/local/bin.

21 let entryPoint;

22 try {

23 entryPoint = realpathSync(process.argv[1] ?? process.cwd());

24 }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install/setup-wizard.jsView on unpkg · L22

25 catch {

26 entryPoint = process.argv[1] ?? process.cwd();

27 }

28 return resolve(dirname(entryPoint), '..', '..', 'examples', 'local-alert-rules.json');

29}

30/**

31 * Copy the bundled starter alert rules into the destination path. Idempotent:

32 * if the destination already exists, the function leaves it alone (so a

33 * user-edited rules file is never clobbered by a re-run of `setup`). The

34 * destination directory is created with `0o700` if missing; the file is

35 * written with `0o600`.

36 */

37export function copyStarterAlertRules(opts) {

38 const { sourcePath, destPath, logger } = opts;

39 if (existsSync(destPath)) {

40 logger?.info('alerts: rules file already exists; skipping copy', {

41 destPath,

42 });

Source & flagged code

1 flagged · loading source

dist/install/setup-wizard.jsView file

22try { L23: entryPoint = realpathSync(process.argv[1] ?? process.cwd()); L24: } ... L69: function print(msg = '') { L70: process.stdout.write(msg + '\n'); L71: } ... L74: try { L75: parsed = JSON.parse(readFileSync(CONFIG_PATH, 'utf-8')); L76: } ... L170: if (mode !== 'local') { L171: const envAccountId = process.env.NEW_RELIC_ACCOUNT_ID?.trim() ?? ''; L172: const existingAccountId = typeof existing.accountId === 'string' ? existing.accountId : '';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install/setup-wizard.jsView on unpkg · L22

Findings

4 Medium5 Low

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/install/setup-wizard.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/install/setup-wizard.jsView file

Lines 2-42javascript

2import { mkdirSync, readFileSync, existsSync, copyFileSync, chmodSync, realpathSync, } from 'node:fs';

3import { resolve, dirname } from 'node:path';

4import { normalizeDeveloperName, ConfigFileSchema, DEFAULT_STORAGE_PATH } from '../config.js';

5import { migrateStoragePath } from './migrate.js';

6import { runInstallCli, verifyBinaryOnPath, findRepoRoot } from './cli.js';

7import { writeJsonFile } from './json-utils.js';

8import { installSchedule, installDashboardDaemon, resolveBinaryPath } from './schedule.js';

9import { isWsl, resolveWindowsHome } from './platform.js';

10import { validateLicenseKey, validateApiKey } from './key-validator.js';

11const CONFIG_PATH = resolve(DEFAULT_STORAGE_PATH, 'config.json');

12const ALERT_RULES_DEST = resolve(DEFAULT_STORAGE_PATH, 'alerts', 'rules.json');

13function defaultStarterRulesSource() {

14 const root = findRepoRoot();

15 if (root !== null)

16 return resolve(root, 'examples', 'local-alert-rules.json');

17 // findRepoRoot() failed — fall back to walking two directories up from the

18 // real entry-point path. Resolve symlinks first so a globally-installed binary

19 // (e.g. /usr/local/bin/preflight → .../node_modules/preflight/dist/index.js)

20 // correctly walks up to the package root rather than /usr/local/bin.

21 let entryPoint;

22 try {

23 entryPoint = realpathSync(process.argv[1] ?? process.cwd());

24 }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install/setup-wizard.jsView on unpkg · L22

25 catch {

26 entryPoint = process.argv[1] ?? process.cwd();

27 }

28 return resolve(dirname(entryPoint), '..', '..', 'examples', 'local-alert-rules.json');

29}

30/**

31 * Copy the bundled starter alert rules into the destination path. Idempotent:

32 * if the destination already exists, the function leaves it alone (so a

33 * user-edited rules file is never clobbered by a re-run of `setup`). The

34 * destination directory is created with `0o700` if missing; the file is

35 * written with `0o600`.

36 */

37export function copyStarterAlertRules(opts) {

38 const { sourcePath, destPath, logger } = opts;

39 if (existsSync(destPath)) {

40 logger?.info('alerts: rules file already exists; skipping copy', {

41 destPath,

42 });