@redocly/cli@2.39.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@redocly/cli@2.39.0: Clean npm security report (Allow) | LPM Firewall

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

`lib/index.js` sends opt-out telemetry after CLI commands.
`lib/chunks/BA5AZJUM.js` stores OAuth credentials under `~/.redocly/credentials` for explicit login.
`lib/index.js` dynamically evaluates scorecard plugin code supplied to that user-invoked command.

Evidence against

`package.json` declares no lifecycle scripts; install does not execute package code.
`bin/cli.js` only imports `lib/index.js` when the CLI is invoked.
`BA5AZJUM.js` restricts Redocly service URLs to HTTPS and named Redocly domains/residencies.
The only shell execution opens the OAuth device-login browser; other `execSync` reads `npm -v` for telemetry.
No source evidence of credential harvesting, foreign agent-control writes, hidden persistence, or remote payload execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 4.85 MB of source, external domains: app.cloud.eu.redocly.com, app.cloud.redocly.com, cdn.redocly.com, commonmark.org, dotenvx.com, en.wikipedia.org, example.com, fetch.spec.whatwg.org, fonts.googleapis.com, gist.github.com, git.io, github.com, jedwatson.github.io, json-schema.org, json.schemastore.org, lea.verou.me, lunrjs.com, markjs.io, mathiasbynens.be, mimesniff.spec.whatwg.org, opensource.org, otel.cloud.redocly.com, raw.githubusercontent.com, react.dev, redocly.com, registry.npmjs.org, spec.openapis.org, stackoverflow.com, tartarus.org, tools.ietf.org, wd.dizaina.net, webidl.spec.whatwg.org, www.w3.org, yarnpkg.com

Oversized source lightweight scan

lib/chunks/OVY6O6WL.js4.21 MB file, sampled 256 KB

ChildProcessHighEntropyStrings

lib/chunks/V74PIVJZ.js3.87 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsTelemetryUrlStringscdn.redocly.comfonts.googleapis.comgit.iogithub.comjedwatson.github.iolea.verou.melunrjs.commarkjs.ioopensource.orgreact.devtartarus.orgwd.dizaina.net

Source & flagged code

11 flagged · loading source

lib/chunks/KYZEVOA2.jsView file

20629patternName = generic_password severity = medium line = 20629 matchedText = password...ow",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunks/KYZEVOA2.jsView on unpkg · L20629

22901patternName = generic_password severity = medium line = 22901 matchedText = password...ow",

Medium

Secret Pattern

Hardcoded password in lib/chunks/KYZEVOA2.js

lib/chunks/KYZEVOA2.jsView on unpkg · L22901

5076sourceCode = this.opts.code.process(sourceCode, sch); L5077: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L5078: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/chunks/KYZEVOA2.jsView on unpkg · L5076

lib/index.jsView file

7640// src/commands/eject.ts L7641: import { spawn } from "node:child_process"; L7642:

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L7640

57Cross-file remote execution chain: lib/index.js spawns lib/chunks/C3PXBQU5.js; helper contains network access plus dynamic code execution. L57: import { L58: require_undici L59: } from "./chunks/XB6C62FW.js"; ... L160: "use strict"; L161: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ... L162: }; ... L2118: L2119: // ../../node_modules/dotenv/package.json L2120: var require_package = __commonJS({ ... L2218: if (!result.parsed) { L2219: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L2220: err.code = "MISSING_DATA";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/index.jsView on unpkg · L57

2import { createRequire as __createRequire } from 'node:module'; L3: const require = __createRequire(import.meta.url); L4: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/index.jsView on unpkg · L2

57import { L58: require_undici L59: } from "./chunks/XB6C62FW.js"; ... L160: "use strict"; L161: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ... L162: }; ... L2118: L2119: // ../../node_modules/dotenv/package.json L2120: var require_package = __commonJS({ ... L2218: if (!result.parsed) { L2219: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L2220: err.code = "MISSING_DATA";

lib/chunks/BA5AZJUM.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @redocly/cli@2.36.0 matchedIdentity = npm:QHJlZG9jbHkvY2xp:2.36.0 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/chunks/BA5AZJUM.jsView on unpkg

84// src/auth/device-flow.ts L85: import * as childProcess from "node:child_process"; L86: L87: // src/utils/fetch-with-timeout.ts L88: var import_undici = __toESM(require_undici(), 1); L89: ... L92: function getProxyUrl() { L93: return process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.http_proxy || process.env.https_proxy; L94: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunks/BA5AZJUM.jsView on unpkg · L84

12import { L13: require_undici L14: } from "./XB6C62FW.js"; ... L36: function getDomain() { L37: return process.env.REDOCLY_DOMAIN || REUNITE_URLS.us; L38: } ... L84: // src/auth/device-flow.ts L85: import * as childProcess from "node:child_process"; L86: ... L211: async getParsedResponse(response) { L212: const responseBody = await response.json(); L213: if (response.ok) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/chunks/BA5AZJUM.js

lib/chunks/V74PIVJZ.jsView file

•path = lib/chunks/V74PIVJZ.js kind = oversized_source_file sizeBytes = 4060390 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/chunks/V74PIVJZ.jsView on unpkg