registry / @salesforce/b2c-cli / 2.5.0
@salesforce/b2c-cli@2.5.0
A Salesforce B2C Commerce CLI
AI Security Review
scanned 28d ago · by lpm-firewall-aiSource inspection supports ordinary CLI and authentication behavior. The manifest has no install lifecycle hook, and the flagged skill command reads and displays bundled guidance rather than executing it.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the relevant CLI command.
Impact
No confirmed malicious effect or attack surface was established.
Mechanism
The skill command reads and displays catalog content; the auth command posts supplied credentials to the Account Manager host and stores the resulting session.
AI rationale
Source inspection supports ordinary CLI and authentication behavior. The manifest has no install lifecycle hook, and the flagged skill command reads and displays bundled guidance rather than executing it.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies a Salesforce B2C CLI and its executable entry point; its scripts include build and test commands, with no install lifecycle hook.
- The flagged skill command reads catalog entries and returns or prints their content when invoked.
- The auth client sends caller-provided credentials to the configured Account Manager host over HTTPS and saves the returned session.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/commands/_test/index.jsView file
30patternName = generic_password
severity = medium
line = 30
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/commands/_test/index.jsView on unpkg · L30bin/dev.cmdView file
•path = bin/dev.cmd
kind = build_helper
sizeBytes = 193
magicHex = [redacted]
Medium
dist/commands/docs/skill.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @salesforce/b2c-cli@2.3.1
matchedIdentity = npm:QHNhbGVzZm9yY2UvYjJjLWNsaQ:2.3.1
similarity = 0.933
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 High5 Medium6 Low
HighPrevious Version Dangerous Deltadist/commands/docs/skill.js
MediumSecret Patterndist/commands/_test/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @salesforce/b2c-cli@2.5.0.
See all versions of @salesforce/b2c-cli for other recorded verdicts.
- Review the evidence and your use of @salesforce/b2c-cli@2.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.