registry / @salesforce/b2c-cli / 2.5.1
@salesforce/b2c-cli@2.5.1
A Salesforce B2C Commerce CLI
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe inspected entrypoints start the CLI, and the credential transfer occurs within an explicit OAuth login flow to its configured Account Manager host. The scanner's secret-pattern finding is explained by sample values in a logger redaction test.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the CLI authentication command.
Impact
The inspected behavior supports normal authentication; no malicious effect was established.
Mechanism
The command sends supplied OAuth credentials to the Account Manager host selected through configuration, then saves the returned session.
AI rationale
The inspected entrypoints start the CLI, and the credential transfer occurs within an explicit OAuth login flow to its configured Account Manager host. The scanner's secret-pattern finding is explained by sample values in a logger redaction test.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies a Salesforce Commerce CLI and maps its `b2c` command to `bin/run.js`; its inspected scripts contain no registry-install hook.
- The launcher preloads environment configuration and starts the CLI framework.
- The OAuth command accepts an Account Manager host from configuration and builds an access-token URL from that host.
- The command sends its OAuth form body to that configured URL when the user invokes authentication.
- The secret-looking strings in the test command are sample values passed to a logger redaction check.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/commands/_test/index.jsView file
30patternName = generic_password
severity = medium
line = 30
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/commands/_test/index.jsView on unpkg · L30bin/dev.cmdView file
•path = bin/dev.cmd
kind = build_helper
sizeBytes = 193
magicHex = [redacted]
Medium
package.jsonView file
2"name": "@salesforce/b2c-cli",
"description": "A Salesforce B2C Commerce CLI",
"version": "2.5.1",
"author": "Charles Lavery",
"bi
Findings
5 Medium7 Low
MediumSecret Patterndist/commands/_test/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @salesforce/b2c-cli@2.5.1.
See all versions of @salesforce/b2c-cli for other recorded verdicts.
- Review the evidence and your use of @salesforce/b2c-cli@2.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.