registry / @salesforce/b2c-cli / 2.7.1
@salesforce/b2c-cli@2.7.1
A Salesforce B2C Commerce CLI
AI Security Review
scanned 21d ago · by lpm-firewall-aiSource inspection found no npm install lifecycle hook or malicious credential transfer. The flagged network and environment use supports user-invoked OAuth, while plugin installation is scoped to the declared Storefront Next feature.
Static reason
One or more suspicious static signals were detected.
Trigger
The CLI starts when a user runs it; plugin installation is invoked for the Storefront Next command flow.
Impact
The inspected behavior supports normal CLI authentication and feature setup; it does not establish credential theft or unconsented installation-time mutation.
Mechanism
The auth command sends caller-provided OAuth credentials to the configured or default Account Manager endpoint. The plugin hook invokes the declared plugin installation command.
AI rationale
Source inspection found no npm install lifecycle hook or malicious credential transfer. The flagged network and environment use supports user-invoked OAuth, while plugin installation is scoped to the declared Storefront Next feature.
Network endpoints1
${accountManagerHost}/dwsso/oauth2/access_token
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies the package and shows build tooling scripts; no npm install lifecycle hook is declared.
- The CLI loads environment configuration and starts oclif when invoked.
- The manifest declares a Salesforce Storefront Next JIT plugin; its hook runs the plugin install command, and the local override is limited to SFNext commands.
- The auth command builds an Account Manager OAuth request from supplied credentials and sends it to the configured or default Account Manager host.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/commands/_test/index.jsView file
30patternName = generic_password
severity = medium
line = 30
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/commands/_test/index.jsView on unpkg · L30bin/dev.cmdView file
•path = bin/dev.cmd
kind = build_helper
sizeBytes = 193
magicHex = [redacted]
Medium
package.jsonView file
1{
"name": "@salesforce/b2c-cli",
"description": "A Salesforce B2C Commerce CLI",
"version": "2.7.1",
"author": "Charles Lavery",
"bin": {
Findings
5 Medium7 Low
MediumSecret Patterndist/commands/_test/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/run.js
Affected versions and remediation
This report applies to @salesforce/b2c-cli@2.7.1.
See all versions of @salesforce/b2c-cli for other recorded verdicts.
- Review the evidence and your use of @salesforce/b2c-cli@2.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.