@redocly/cli@2.36.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@redocly/cli@2.36.0: Clean npm security report (Allow) | LPM Firewall

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for block

lib/index.js runs cacheLatestVersion() at CLI startup and may query npm registry
lib/index.js sends default telemetry to Redocly unless REDOCLY_TELEMETRY/config disables it
lib/index.js spawns npx for user-invoked eject/preview/translate commands
lib/chunks/FMJFZCNQ.js stores OAuth credentials under ~/.redocly/credentials

Evidence against

package.json declares no lifecycle scripts, only bin entries to bin/cli.js
bin/cli.js only imports ../lib/index.js; no install-time execution path
child_process usage is tied to explicit CLI commands or browser opening for login
network hosts are Redocly cloud/telemetry, npm registry update check, or user/config-provided Reunite URLs with HTTPS validation
telemetry masks selected sensitive CLI args and can be disabled
No AI-agent control-surface, persistence hook, destructive code, or credential exfiltration sink found

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 4.02 MB of source, external domains: app.cloud.eu.redocly.com, app.cloud.redocly.com, cdn.redocly.com, dotenvx.com, example.com, fetch.spec.whatwg.org, fonts.googleapis.com, gist.github.com, git.io, github.com, jedwatson.github.io, json-schema.org, lea.verou.me, lunrjs.com, markjs.io, mathiasbynens.be, mimesniff.spec.whatwg.org, opensource.org, otel.cloud.redocly.com, raw.githubusercontent.com, react.dev, redocly.com, registry.npmjs.org, spec.openapis.org, stackoverflow.com, tartarus.org, tools.ietf.org, wd.dizaina.net, webidl.spec.whatwg.org, www.w3.org

Oversized source lightweight scan

lib/chunks/35B2IXV3.js4.21 MB file, sampled 256 KB

ChildProcessHighEntropyStrings

lib/chunks/XTSKVMID.js3.87 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsTelemetryUrlStringscdn.redocly.comfonts.googleapis.comgit.iogithub.comjedwatson.github.iolea.verou.melunrjs.commarkjs.ioopensource.orgreact.devtartarus.orgwd.dizaina.net

Source & flagged code

10 flagged · loading source

lib/chunks/UVIPIXTL.jsView file

20739patternName = generic_password severity = medium line = 20739 matchedText = password...ow",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunks/UVIPIXTL.jsView on unpkg · L20739

22138patternName = generic_password severity = medium line = 22138 matchedText = password...ow",

Medium

Secret Pattern

Hardcoded password in lib/chunks/UVIPIXTL.js

lib/chunks/UVIPIXTL.jsView on unpkg · L22138

5071sourceCode = this.opts.code.process(sourceCode, sch); L5072: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L5073: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/chunks/UVIPIXTL.jsView on unpkg · L5071

lib/index.jsView file

7634// src/commands/eject.ts L7635: import { spawn } from "node:child_process"; L7636:

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L7634

41Cross-file remote execution chain: lib/index.js spawns lib/chunks/FMJFZCNQ.js; helper contains network access plus dynamic code execution. L41: getReuniteUrl, L42: require_undici, L43: shouldBypassProxy ... L154: "use strict"; L155: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ... L156: }; ... L2112: L2113: // ../../node_modules/dotenv/package.json L2114: var require_package = __commonJS({ ... L2212: if (!result.parsed) { L2213: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L2214: err.code = "MISSING_DATA";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/index.jsView on unpkg · L41

2import { createRequire as __createRequire } from 'node:module'; L3: const require = __createRequire(import.meta.url); L4: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/index.jsView on unpkg · L2

41getReuniteUrl, L42: require_undici, L43: shouldBypassProxy ... L154: "use strict"; L155: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ... L156: }; ... L2112: L2113: // ../../node_modules/dotenv/package.json L2114: var require_package = __commonJS({ ... L2212: if (!result.parsed) { L2213: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L2214: err.code = "MISSING_DATA";

lib/chunks/FMJFZCNQ.jsView file

18562// src/auth/device-flow.ts L18563: import * as childProcess from "node:child_process"; L18564: L18565: // src/utils/fetch-with-timeout.ts L18566: var import_undici = __toESM(require_undici(), 1); L18567: ... L18570: function getProxyUrl() { L18571: return process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.http_proxy || process.env.https_proxy; L18572: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunks/FMJFZCNQ.jsView on unpkg · L18562

22L23: // ../../node_modules/undici/lib/core/symbols.js L24: var require_symbols = __commonJS({ ... L47: kBodyUsed: /* @__PURE__ */ Symbol("used"), L48: kBody: /* @__PURE__ */ Symbol("abstracted request body"), L49: kRunning: /* @__PURE__ */ Symbol("running"), ... L596: } L597: const code = this.code = key.charCodeAt(index); L598: if (code > 127) { ... L2019: * @type {-2|-1|0|1} L2020: * @private L2021: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/chunks/FMJFZCNQ.jsView on unpkg · L22

lib/chunks/XTSKVMID.jsView file

•path = lib/chunks/XTSKVMID.js kind = oversized_source_file sizeBytes = 4060310 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/chunks/XTSKVMID.jsView on unpkg

Source & flagged code

10 flagged

lib/chunks/UVIPIXTL.jsView file

20739patternName = generic_password severity = medium line = 20739 matchedText = password...ow",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunks/UVIPIXTL.jsView on unpkg · L20739

22138patternName = generic_password severity = medium line = 22138 matchedText = password...ow",

Medium

Secret Pattern

Hardcoded password in lib/chunks/UVIPIXTL.js

lib/chunks/UVIPIXTL.jsView on unpkg · L22138

5071sourceCode = this.opts.code.process(sourceCode, sch); L5072: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L5073: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/chunks/UVIPIXTL.jsView on unpkg · L5071

lib/index.jsView file

Lines 1-61javascript

1#!/usr/bin/env node

2import { createRequire as __createRequire } from 'node:module';

3const require = __createRequire(import.meta.url);

4import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/index.jsView on unpkg · L2

lib/chunks/FMJFZCNQ.jsView file

18562// src/auth/device-flow.ts L18563: import * as childProcess from "node:child_process"; L18564: L18565: // src/utils/fetch-with-timeout.ts L18566: var import_undici = __toESM(require_undici(), 1); L18567: ... L18570: function getProxyUrl() { L18571: return process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.http_proxy || process.env.https_proxy; L18572: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunks/FMJFZCNQ.jsView on unpkg · L18562

22L23: // ../../node_modules/undici/lib/core/symbols.js L24: var require_symbols = __commonJS({ ... L47: kBodyUsed: /* @__PURE__ */ Symbol("used"), L48: kBody: /* @__PURE__ */ Symbol("abstracted request body"), L49: kRunning: /* @__PURE__ */ Symbol("running"), ... L596: } L597: const code = this.code = key.charCodeAt(index); L598: if (code > 127) { ... L2019: * @type {-2|-1|0|1} L2020: * @private L2021: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/chunks/FMJFZCNQ.jsView on unpkg · L22

lib/chunks/XTSKVMID.jsView file

•path = lib/chunks/XTSKVMID.js kind = oversized_source_file sizeBytes = 4060310 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/chunks/XTSKVMID.jsView on unpkg