registry / @salesforce/b2c-cli / 2.10.0
@salesforce/b2c-cli@2.10.0
⚠ Under reviewA Salesforce B2C Commerce CLI
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe inspected launcher and package entrypoint show normal CLI setup, with no confirmed attack behavior. Because the primary runtime SDK source was unavailable, the unresolved dependency prevents a clean verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the b2c command starts the CLI and imports the tooling SDK.
Impact
The inspected source does not establish an attack, but the unavailable SDK source prevents a clean assessment of the primary runtime behavior.
Mechanism
The launcher imports SDK configuration support, while the package re-exports SDK command and configuration APIs; the SDK implementation was not available for inspection.
AI rationale
The inspected launcher and package entrypoint show normal CLI setup, with no confirmed attack behavior. Because the primary runtime SDK source was unavailable, the unresolved dependency prevents a clean verdict.
Evidence
package.jsonbin/run.jsdist/index.js
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest names a command-line entrypoint and declares the matching Salesforce tooling SDK as a runtime dependency.
- The launcher imports configuration support from that SDK, and the package re-exports its command and configuration APIs.
- The SDK source was unavailable in the inspected package snapshot, so its runtime behavior could not be verified.
Evidence against
- No preinstall or postinstall hook was found in the manifest, and the inspected launcher starts the CLI after loading environment configuration.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/commands/_test/index.jsView file
30patternName = generic_password
severity = medium
line = 30
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/commands/_test/index.jsView on unpkg · L30bin/dev.cmdView file
•path = bin/dev.cmd
kind = build_helper
sizeBytes = 193
magicHex = [redacted]
Medium
package.jsonView file
1{
"name": "@salesforce/b2c-cli",
"description": "A Salesforce B2C Commerce CLI",
"version": "2.10.0",
"author": "Charles Lavery",
"bin": {
"b2c": "./bin/run.js"
},
"bugs": "https://github.com/SalesforceCommerceCloud/b2c-de
Findings
5 Medium7 Low
MediumSecret Patterndist/commands/_test/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencebin/run.js
Affected versions and remediation
This report applies to @salesforce/b2c-cli@2.10.0.
See all versions of @salesforce/b2c-cli for other recorded verdicts.
- Review the evidence and your use of @salesforce/b2c-cli@2.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.