@salesforce/b2c-cli@2.9.0
⚠ Under reviewA Salesforce B2C Commerce CLI
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the inspected hooks are limited to command-triggered plugin handling. The pinned tooling SDK supplies core authentication and CLI functions, but its source was not available, so the runtime behavior cannot be resolved from this inspection.
Decision evidence
public snapshot- The CLI entrypoint loads configuration and starts the command runner.
- The package imports its pinned tooling SDK for authentication and CLI operations; the SDK source was not available in the inspected snapshot.
- The local SFNext override hook runs only for SFNext command IDs.
- The JIT hook installs a declared plugin when its command is invoked.
- The manifest declares no npm install lifecycle hook.
- The main entrypoint re-exports the CLI runner and SDK utilities.
Source & flagged code
5 flaggedPackage contains a possible secret pattern.
dist/commands/_test/index.jsView on unpkg · L30The package imports its pinned tooling SDK for authentication and CLI operations; the SDK source was not available in the inspected snapshot.
package.jsonView on unpkg · L28The package imports its pinned tooling SDK for authentication and CLI operations; the SDK source was not available in the inspected snapshot.
dist/commands/auth/login.jsView on unpkg · L8The local SFNext override hook runs only for SFNext command IDs.
dist/hooks/sfnext-local-override.jsView on unpkg · L33Findings
Affected versions and remediation
This report applies to @salesforce/b2c-cli@2.9.0.
See all versions of @salesforce/b2c-cli for other recorded verdicts.
- Review the evidence and your use of @salesforce/b2c-cli@2.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.