registry / @salesforce/b2c-cli / 2.0.0
@salesforce/b2c-cli@2.0.0
A Salesforce B2C Commerce CLI
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe reachable JIT installation hook creates a command-time extension supply-chain risk because it selects latest. Static inspection found no concrete malicious payload or automatic install-time mutation.
Static reason
One or more suspicious static signals were detected.
Trigger
Invoking a command whose JIT plugin is not installed.
Impact
The CLI may download and activate a mutable third-party extension at command time.
Mechanism
The Oclif event hook calls the framework's plugin-install command for the requested plugin.
AI rationale
The reachable JIT installation hook creates a command-time extension supply-chain risk because it selects latest. Static inspection found no concrete malicious payload or automatic install-time mutation.
Evidence
package.jsondist/hooks/sfnext-jit-install.jsbin/run.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest registers a JIT plugin using the mutable latest tag and connects an Oclif missing-plugin event to an install hook.
- The hook invokes Oclif's JIT plugin-install command with the event-provided plugin name.
- The executable launcher starts the Oclif command framework, making the configured hooks reachable during CLI use.
Evidence against
- No npm preinstall, install, or postinstall lifecycle script is declared.
- The observed installation path is limited to a named Salesforce plugin and is activated through the CLI framework; no credential send, destructive action, or unrelated endpoint was found.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/commands/_test/index.jsView file
30patternName = generic_password
severity = medium
line = 30
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/commands/_test/index.jsView on unpkg · L30bin/dev.cmdView file
•path = bin/dev.cmd
kind = build_helper
sizeBytes = 193
magicHex = [redacted]
Medium
package.jsonView file
94"jitPlugins": {
"@salesforce/storefront-next-dev": "latest"
},
"hooks": {
"init": "./dist/hooks/sfnext-local-override",
"jit_plugin_not_installed": "./dist/hooks/sfnext-jit-install"
},
"warn-if-update-available": {
"
Findings
1 High7 Medium4 Low
HighMissing Postinstall Targetpackage.json
MediumSecret Patterndist/commands/_test/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/hooks/sfnext-jit-install.js
MediumAi Review Evidencebin/run.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @salesforce/b2c-cli@2.0.0.
See all versions of @salesforce/b2c-cli for other recorded verdicts.
- Review the evidence and your use of @salesforce/b2c-cli@2.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.