registry / @salesforce/b2c-cli / 2.2.0
@salesforce/b2c-cli@2.2.0
A Salesforce B2C Commerce CLI
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains a guarded, latest-tag JIT extension installer. That warrants a warning for extension lifecycle risk, but the evidence does not establish malware or an automatic installation attack.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes an SFNext command whose JIT plugin is absent.
Impact
It can add and execute a newly fetched extension in the CLI environment; no install-time package attack was identified.
Mechanism
The configured hook runs the CLI plugin-install command for the declared JIT plugin.
AI rationale
The package contains a guarded, latest-tag JIT extension installer. That warrants a warning for extension lifecycle risk, but the evidence does not establish malware or an automatic installation attack.
Evidence
package.jsondist/hooks/sfnext-jit-install.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest declares a latest-tag JIT plugin and routes the missing-plugin event to an install hook.
- That hook invokes the CLI plugin installer with the JIT option after the matching command is invoked.
Evidence against
- No npm preinstall, install, or postinstall lifecycle script is declared.
- The installation path is guarded by the JIT-plugin event rather than package installation.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/commands/_test/index.jsView file
30patternName = generic_password
severity = medium
line = 30
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/commands/_test/index.jsView on unpkg · L30bin/dev.cmdView file
•path = bin/dev.cmd
kind = build_helper
sizeBytes = 193
magicHex = [redacted]
Medium
package.jsonView file
94"jitPlugins": {
"@salesforce/storefront-next-dev": "latest"
},
"hooks": {
"init": "./dist/hooks/sfnext-local-override",
"jit_plugin_not_installed": "./dist/hooks/sfnext-j
Findings
1 High6 Medium4 Low
HighMissing Postinstall Targetpackage.json
MediumSecret Patterndist/commands/_test/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/hooks/sfnext-jit-install.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @salesforce/b2c-cli@2.2.0.
See all versions of @salesforce/b2c-cli for other recorded verdicts.
- Review the evidence and your use of @salesforce/b2c-cli@2.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.