registry / @sfdt/cli / 0.15.1

@sfdt/cli@0.15.1

Salesforce DevTools — Production-grade CLI for Salesforce DX deployment, testing, quality analysis, and release management

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 158 file(s), 1.73 MB of source, external domains: 127.0.0.1, docs.anthropic.com, github.com, react.dev, registry.npmjs.org, schema.org, soap.sforce.com, www.w3.org

Source & flagged code

5 flagged

package.jsonView file

Lines 41-81json

41 "test:coverage": "vitest run --coverage",

42 "pretest:coverage": "npm run build:flow-core",

43 "lint": "eslint src/ bin/",

44 "lint:fix": "eslint src/ bin/ --fix",

45 "format": "prettier --write \"src/**/*.js\" \"bin/*.js\" \"test/**/*.js\" \"README.md\" \"package.json\"",

46 "dev": "npm link",

47 "build:gui": "npm run build:flow-core && npm run build -w gui",

48 "build:flow-core": "npm run build -w @sfdt/flow-core",

49 "build:ext": "npm run build:flow-core && npm run build -w @sfdt/extension",

50 "build:vscode": "npm run build:flow-core && npm run build -w vscode",

51 "build:plugin": "npm run build -w @sfdt/plugin",

52 "package:ext": "npm run build:ext && npm run zip -w @sfdt/extension",

53 "package:vscode": "npm run package -w vscode",

54 "test:flow-core": "npm run test -w @sfdt/flow-core",

55 "test:extension": "npm run test -w @sfdt/extension",

56 "test:host": "npm run test -w @sfdt/host",

57 "test:vscode": "npm run test -w vscode",

58 "test:plugin": "npm run test -w @sfdt/plugin",

59 "test:all": "npm test && npm run test:flow-core && npm run test:extension && npm run test:host && npm run test:vscode && npm run test:plugin",

60 "dev:ui": "npm run build:gui && npm link && echo '\\n✓ GUI built and linked. cd into your SF project and run: sfdt ui'",

61 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "prepack": "npm run build:gui",

63 "prepublishOnly": "npm test && npm run lint"

64 },

65 "keywords": [

66 "salesforce",

67 "sfdx",

68 "sf",

69 "devtools",

70 "deployment",

71 "testing",

72 "cli",

73 "devops",

74 "apex",

75 "lwc",

76 "package-xml",

77 "release-management"

78 ],

79 "author": "",

80 "license": "MIT",

81 "engines": {

host/src/index.jsView file

Lines 6-46javascript

6 * Protocol (https://developer.chrome.com/docs/apps/nativeMessaging):

7 *

8 * Each message is a UTF-8 JSON document preceded by a 4-byte little-endian

9 * unsigned int containing the document's byte length. Chrome sends up to

10 * 64

src/commands/ui.jsView file

Lines 40-80javascript

40 } else {

41 print.error(`Failed to start server: ${err.message}`);

42 }

43 process.exitCode = 1;

44 return;

45 }

47 // The dashboard authenticates with a one-time launch token generated fresh

scripts/core/compare-preview-vs-pull.shView file

•path = scripts/core/compare-preview-vs-pull.sh kind = build_helper sizeBytes = 3441 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/core/compare-preview-vs-pull.shView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

host/src/index.jsView file

26L27: const require = createRequire(import.meta.url); L28:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

host/src/index.jsView on unpkg · L26

src/commands/ui.jsView file

60package = @sfdt/cli; repositoryIdentity = sfdt; dependency = open L60: try { L61: const { default: open } = await import('open'); L62: await open(url);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/commands/ui.jsView on unpkg · L60

scripts/core/compare-preview-vs-pull.shView file

•path = scripts/core/compare-preview-vs-pull.sh kind = build_helper sizeBytes = 3441 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/core/compare-preview-vs-pull.shView on unpkg

Findings

2 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgesrc/commands/ui.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirehost/src/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/core/compare-preview-vs-pull.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 41-81json

41 "test:coverage": "vitest run --coverage",

42 "pretest:coverage": "npm run build:flow-core",

43 "lint": "eslint src/ bin/",

44 "lint:fix": "eslint src/ bin/ --fix",

45 "format": "prettier --write \"src/**/*.js\" \"bin/*.js\" \"test/**/*.js\" \"README.md\" \"package.json\"",

46 "dev": "npm link",

47 "build:gui": "npm run build:flow-core && npm run build -w gui",

48 "build:flow-core": "npm run build -w @sfdt/flow-core",

49 "build:ext": "npm run build:flow-core && npm run build -w @sfdt/extension",

50 "build:vscode": "npm run build:flow-core && npm run build -w vscode",

51 "build:plugin": "npm run build -w @sfdt/plugin",

52 "package:ext": "npm run build:ext && npm run zip -w @sfdt/extension",

53 "package:vscode": "npm run package -w vscode",

54 "test:flow-core": "npm run test -w @sfdt/flow-core",

55 "test:extension": "npm run test -w @sfdt/extension",

56 "test:host": "npm run test -w @sfdt/host",

57 "test:vscode": "npm run test -w vscode",

58 "test:plugin": "npm run test -w @sfdt/plugin",

59 "test:all": "npm test && npm run test:flow-core && npm run test:extension && npm run test:host && npm run test:vscode && npm run test:plugin",

60 "dev:ui": "npm run build:gui && npm link && echo '\\n✓ GUI built and linked. cd into your SF project and run: sfdt ui'",

61 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 "prepack": "npm run build:gui",

63 "prepublishOnly": "npm test && npm run lint"

64 },

65 "keywords": [

66 "salesforce",

67 "sfdx",

68 "sf",

69 "devtools",

70 "deployment",

71 "testing",

72 "cli",

73 "devops",

74 "apex",

75 "lwc",

76 "package-xml",

77 "release-management"

78 ],

79 "author": "",

80 "license": "MIT",

81 "engines": {

host/src/index.jsView file

Lines 6-46javascript

6 * Protocol (https://developer.chrome.com/docs/apps/nativeMessaging):

7 *

8 * Each message is a UTF-8 JSON document preceded by a 4-byte little-endian

9 * unsigned int containing the document's byte length. Chrome sends up to

10 * 64

src/commands/ui.jsView file

Lines 40-80javascript

40 } else {

41 print.error(`Failed to start server: ${err.message}`);

42 }

43 process.exitCode = 1;

44 return;

45 }

47 // The dashboard authenticates with a one-time launch token generated fresh

scripts/core/compare-preview-vs-pull.shView file

•path = scripts/core/compare-preview-vs-pull.sh kind = build_helper sizeBytes = 3441 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/core/compare-preview-vs-pull.shView on unpkg