registry / @sasjs/cli / 4.18.2

@sasjs/cli@4.18.2

Command line interface for SASjs

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The risky primitives are CLI features for scaffolding SASjs projects, generating docs, and calling user-configured SASjs servers.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User invokes sasjs CLI commands such as create, doc, or server-related operations

Impact

Expected project file creation and command execution for SASjs workflows; no credential harvesting or covert persistence found

Mechanism

user-invoked project scaffolding, downloads, shell execution, and SASjs API access

Rationale

Static inspection found potentially dangerous primitives, but they are package-aligned and activated by explicit CLI workflows rather than install/import-time covert behavior. The prepare hook is undesirable but only points this package repo at its own .git-hooks and no malicious hook payload or consumer/AI-agent control hijack was found.

Evidence

package.jsonbuild/index.jsbuild/cli.jsbuild/utils/utils.jsbuild/utils/loadEnvVariables.jsbuild/commands/create/create.jsbuild/commands/docs/generateDocs.jsbuild/utils/setProjectDir.jsbuild/commands/create/createCommand.js

Network endpoints6

github.com/sasjs/react-seed-appgithub.com/sasjs/angular-seed-appgithub.com/sasjs/minimal-seed-appgithub.com/sasjs/docsgithub.com/sasjs/template_<template><target.serverUrl>/SASjsApi/info

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json has prepare script: git rev-parse --git-dir && git config core.hooksPath ./.git-hooks || true
build/utils/utils.js uses shelljs.exec for wget/curl/powershell downloads and npm install during sasjs create
build/commands/docs/generateDocs.js builds a shell command to run doxygen with project-derived paths

Evidence against

build/index.js only dispatches CLI args to ./cli; no import-time payload observed
Network activity is tied to user-invoked SASjs create/docs/server commands and SASjs/GitHub/user target URLs
Runtime npm install occurs after explicit sasjs create scaffolding, inside the requested project folder
Env reads load local .env/.env.target for SAS credentials but no exfiltration sink was found
No AI-agent control-surface files or foreign agent config writes found

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 283 file(s), 2.34 MB of source, external domains: api.agify.io, cli.sasjs.io, core.sasjs.io, example.com, github.com, raw.githubusercontent.com, sasjs.io, sasjsserver.com, server.com, support.sas.com, test.sasjs, www.contributor-covenant.org, www.conventionalcommits.org, www.doxygen.nl

Source & flagged code

7 flagged

build/commands/create/spec/create.spec.jsView file

Lines 40-80javascript

40};

41Object.defineProperty(exports, "__esModule", { value: true });

42var dotenv_1 = __importDefault(require("dotenv"));

43var path_1 = __importDefault(require("path"));

44var test_1 = require("../../../utils/test");

45var utils_1 = require("@sasjs/utils");

46var config_1 = require("../../../utils/config");

47var minimalAppFiles_1 = require("./minimalAppFiles");

48var reactAppFiles_1 = require("./reactAppFiles");

49var angularAppFiles_1 = require("./angularAppFiles");

50var create_1 = require("../create");

51var utils_2 = require("../../../utils");

52var shelljs_1 = __importDefault(require("shelljs"));

53describe('sasjs create', function () {

54 beforeAll(function () {

55 dotenv_1.default.config();

56 });

57 beforeEach(function () {

58 var exec = shelljs_1.default.exec;

59 jest.spyOn(shelljs_1.default, 'exec').mockImplementation(function (command) {

60 if (!command.includes('npm install')) {

61 return exec(command, {

62 silent: true

High

Child Process

Package source references child process execution.

build/commands/create/spec/create.spec.jsView on unpkg · L60

63 });

64 }

65 return undefined;

66 });

67 });

68 afterEach(function () { return __awaiter(void 0, void 0, void 0, function () {

69 return __generator(this, function (_a) {

70 switch (_a.label) {

71 case 0:

72 if (!process.projectDir) return [3 /*break*/, 2];

73 return [4 /*yield*/, (0, utils_1.deleteFolder)(process.projectDir)];

74 case 1:

75 _a.sent();

76 _a.label = 2;

77 case 2: return [2 /*return*/];

78 }

79 });

80 }); });

build/utils/utils.jsView file

Lines 72-112javascript

72 if (!ar) ar = Array.prototype.slice.call(from, 0, i);

73 ar[i] = from[i];

74 }

75 }

76 return to.concat(ar || Array.prototype.slice.call

build/commands/docs/generateDocs.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sasjs/cli@4.18.1 matchedIdentity = npm:QHNhc2pzL2NsaQ:4.18.1 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/commands/docs/generateDocs.jsView on unpkg

build/commands/add/spec/addTarget.spec.jsView file

Lines 217-257javascript

217 case 0:

218 commonFields = {

219 scope: targetScope_1.TargetScope.Local,

220 serverType: utils_1.ServerType.Sas9,

221 name: sas9TargetName,

222 appLoc: '/Public/app',

223 serverUrl: serverUrl,

224 existingTarget: {}

225 };

build/commands/job/spec/jobCommand.spec.jsView file

Lines 94-134javascript

94var jobCommand_1 = require("../jobCommand");

95var utils_1 = require("@sasjs/utils");

96var SasjsUtilsFilesModule = __importStar(require("@sasjs/utils/file"));

97var configUtils = __importStar(require

Source & flagged code

7 flagged · loading source

build/commands/create/spec/create.spec.jsView file

60if (!command.includes('npm install')) { L61: return exec(command, { L62: silent: true

High

Child Process

Package source references child process execution.

build/commands/create/spec/create.spec.jsView on unpkg · L60

build/utils/utils.jsView file

92Object.defineProperty(exports, "__esModule", { value: true }); L93: exports.isSasJsServerInServerMode = exports.getNodeModulePath = exports.isSASjsProject = exports.terminateProcess = exports.prefixAppLoc = exports.loadEnvVariables = exports.displa... L94: var shelljs_1 = __importDefault(require("shelljs"));

High

Shell

Package source references shell execution.

build/utils/utils.jsView on unpkg · L92

326(_c = process.logger) === null || _c === void 0 ? void 0 : _c.info('Installing @sasjs/core'); L327: shelljs_1.default.exec("cd \"".concat(folderPath, "\" && npm i @sasjs/core --save"), { L328: silent: true

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

build/utils/utils.jsView on unpkg · L326

build/commands/docs/generateDocs.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/commands/docs/generateDocs.jsView on unpkg

build/commands/add/spec/addTarget.spec.jsView file

237patternName = generic_password severity = medium line = 237 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in build/commands/add/spec/addTarget.spec.js

build/commands/add/spec/addTarget.spec.jsView on unpkg · L237

359patternName = generic_password severity = medium line = 359 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in build/commands/add/spec/addTarget.spec.js

build/commands/add/spec/addTarget.spec.jsView on unpkg · L359

build/commands/job/spec/jobCommand.spec.jsView file

114patternName = generic_password severity = medium line = 114 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in build/commands/job/spec/jobCommand.spec.js

build/commands/job/spec/jobCommand.spec.jsView on unpkg · L114

Findings

1 Critical3 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltabuild/commands/docs/generateDocs.js

HighChild Processbuild/commands/create/spec/create.spec.js

HighShellbuild/utils/utils.js

HighRuntime Package Installbuild/utils/utils.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternbuild/commands/add/spec/addTarget.spec.js

MediumSecret Patternbuild/commands/job/spec/jobCommand.spec.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

build/commands/create/spec/create.spec.jsView file

Lines 40-80javascript

40};

41Object.defineProperty(exports, "__esModule", { value: true });

42var dotenv_1 = __importDefault(require("dotenv"));

43var path_1 = __importDefault(require("path"));

44var test_1 = require("../../../utils/test");

45var utils_1 = require("@sasjs/utils");

46var config_1 = require("../../../utils/config");

47var minimalAppFiles_1 = require("./minimalAppFiles");

48var reactAppFiles_1 = require("./reactAppFiles");

49var angularAppFiles_1 = require("./angularAppFiles");

50var create_1 = require("../create");

51var utils_2 = require("../../../utils");

52var shelljs_1 = __importDefault(require("shelljs"));

53describe('sasjs create', function () {

54 beforeAll(function () {

55 dotenv_1.default.config();

56 });

57 beforeEach(function () {

58 var exec = shelljs_1.default.exec;

59 jest.spyOn(shelljs_1.default, 'exec').mockImplementation(function (command) {

60 if (!command.includes('npm install')) {

61 return exec(command, {

62 silent: true

High

Child Process

Package source references child process execution.

build/commands/create/spec/create.spec.jsView on unpkg · L60

63 });

64 }

65 return undefined;

66 });

67 });

68 afterEach(function () { return __awaiter(void 0, void 0, void 0, function () {

69 return __generator(this, function (_a) {

70 switch (_a.label) {

71 case 0:

72 if (!process.projectDir) return [3 /*break*/, 2];

73 return [4 /*yield*/, (0, utils_1.deleteFolder)(process.projectDir)];

74 case 1:

75 _a.sent();

76 _a.label = 2;

77 case 2: return [2 /*return*/];

78 }

79 });

80 }); });

build/utils/utils.jsView file

Lines 72-112javascript

72 if (!ar) ar = Array.prototype.slice.call(from, 0, i);

73 ar[i] = from[i];

74 }

75 }

76 return to.concat(ar || Array.prototype.slice.call

build/commands/docs/generateDocs.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/commands/docs/generateDocs.jsView on unpkg

build/commands/add/spec/addTarget.spec.jsView file

Lines 217-257javascript

217 case 0:

218 commonFields = {

219 scope: targetScope_1.TargetScope.Local,

220 serverType: utils_1.ServerType.Sas9,

221 name: sas9TargetName,

222 appLoc: '/Public/app',

223 serverUrl: serverUrl,

224 existingTarget: {}

225 };

build/commands/job/spec/jobCommand.spec.jsView file

Lines 94-134javascript

94var jobCommand_1 = require("../jobCommand");

95var utils_1 = require("@sasjs/utils");

96var SasjsUtilsFilesModule = __importStar(require("@sasjs/utils/file"));

97var configUtils = __importStar(require