registry / @sfdt/cli / 0.16.1

@sfdt/cli@0.16.1

Salesforce DevTools — Production-grade CLI for Salesforce DX deployment, testing, quality analysis, and release management

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 172 file(s), 1.93 MB of source, external domains: 127.0.0.1, docs.anthropic.com, github.com, react.dev, registry.npmjs.org, schema.org, soap.sforce.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 42-82json

42 "test:coverage": "vitest run --coverage",

43 "pretest:coverage": "npm run build:flow-core",

44 "lint": "eslint src/ bin/",

45 "lint:fix": "eslint src/ bin/ --fix",

46 "format": "prettier --write \"src/**/*.js\" \"bin/*.js\" \"test/**/*.js\" \"README.md\" \"package.json\"",

47 "dev": "npm link",

48 "build:gui": "npm run build:flow-core && npm run build -w gui",

49 "build:flow-core": "npm run build -w @sfdt/flow-core",

50 "build:ext": "npm run build:flow-core && npm run build -w @sfdt/extension",

51 "build:vscode": "npm run build:flow-core && npm run build -w vscode",

52 "build:plugin": "npm run build -w @sfdt/plugin",

53 "package:ext": "npm run build:ext && npm run zip -w @sfdt/extension",

54 "package:vscode": "npm run package -w vscode",

55 "test:flow-core": "npm run test -w @sfdt/flow-core",

56 "test:extension": "npm run test -w @sfdt/extension",

57 "test:host": "npm run test -w @sfdt/host",

58 "test:vscode": "npm run test -w vscode",

59 "test:plugin": "npm run test -w @sfdt/plugin",

60 "test:all": "npm test && npm run test:flow-core && npm run test:extension && npm run test:host && npm run test:vscode && npm run test:plugin",

61 "dev:ui": "npm run build:gui && npm link && echo '\\n✓ GUI built and linked. cd into your SF project and run: sfdt ui'",

62 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 "prepack": "npm run build:gui",

64 "prepublishOnly": "npm test && npm run lint"

65 },

66 "keywords": [

67 "salesforce",

68 "sfdx",

69 "sf",

70 "devtools",

71 "deployment",

72 "testing",

73 "cli",

74 "devops",

75 "apex",

76 "lwc",

77 "package-xml",

78 "release-management"

79 ],

80 "author": "",

81 "license": "Apache-2.0",

82 "engines": {

host/src/index.jsView file

Lines 10-50javascript

10 * 64 MB per message; the host may reply with up to 1 MB.

11 *

12 * Why this exists: the extension's primary transport is HTTP to the running

13 * `sfdt ui` server on http://127.0.0.1:7654. When that server is not running,

src/commands/ui.jsView file

Lines 40-80javascript

40 } else {

41 print.error(`Failed to start server: ${err.message}`);

42 }

43 process.exitCode = 1;

44 return;

45 }

47 // The dashboard authenticates with a one-time launch token generated fresh

scripts/core/compare-preview-vs-pull.shView file

•path = scripts/core/compare-preview-vs-pull.sh kind = build_helper sizeBytes = 3156 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/core/compare-preview-vs-pull.shView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

host/src/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sfdt/cli@0.15.2 matchedIdentity = npm:QHNmZHQvY2xp:0.15.2 similarity = 0.658 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

host/src/index.jsView on unpkg

30L31: const require = createRequire(import.meta.url); L32:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

host/src/index.jsView on unpkg · L30

src/commands/ui.jsView file

60package = @sfdt/cli; repositoryIdentity = sfdt; dependency = open L60: try { L61: const { default: open } = await import('open'); L62: await open(url);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/commands/ui.jsView on unpkg · L60

scripts/core/compare-preview-vs-pull.shView file

•path = scripts/core/compare-preview-vs-pull.sh kind = build_helper sizeBytes = 3156 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/core/compare-preview-vs-pull.shView on unpkg

Findings

3 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgesrc/commands/ui.js

HighPrevious Version Dangerous Deltahost/src/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirehost/src/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/core/compare-preview-vs-pull.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 42-82json

42 "test:coverage": "vitest run --coverage",

43 "pretest:coverage": "npm run build:flow-core",

44 "lint": "eslint src/ bin/",

45 "lint:fix": "eslint src/ bin/ --fix",

46 "format": "prettier --write \"src/**/*.js\" \"bin/*.js\" \"test/**/*.js\" \"README.md\" \"package.json\"",

47 "dev": "npm link",

48 "build:gui": "npm run build:flow-core && npm run build -w gui",

49 "build:flow-core": "npm run build -w @sfdt/flow-core",

50 "build:ext": "npm run build:flow-core && npm run build -w @sfdt/extension",

51 "build:vscode": "npm run build:flow-core && npm run build -w vscode",

52 "build:plugin": "npm run build -w @sfdt/plugin",

53 "package:ext": "npm run build:ext && npm run zip -w @sfdt/extension",

54 "package:vscode": "npm run package -w vscode",

55 "test:flow-core": "npm run test -w @sfdt/flow-core",

56 "test:extension": "npm run test -w @sfdt/extension",

57 "test:host": "npm run test -w @sfdt/host",

58 "test:vscode": "npm run test -w vscode",

59 "test:plugin": "npm run test -w @sfdt/plugin",

60 "test:all": "npm test && npm run test:flow-core && npm run test:extension && npm run test:host && npm run test:vscode && npm run test:plugin",

61 "dev:ui": "npm run build:gui && npm link && echo '\\n✓ GUI built and linked. cd into your SF project and run: sfdt ui'",

62 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 "prepack": "npm run build:gui",

64 "prepublishOnly": "npm test && npm run lint"

65 },

66 "keywords": [

67 "salesforce",

68 "sfdx",

69 "sf",

70 "devtools",

71 "deployment",

72 "testing",

73 "cli",

74 "devops",

75 "apex",

76 "lwc",

77 "package-xml",

78 "release-management"

79 ],

80 "author": "",

81 "license": "Apache-2.0",

82 "engines": {

host/src/index.jsView file

Lines 10-50javascript

10 * 64 MB per message; the host may reply with up to 1 MB.

11 *

12 * Why this exists: the extension's primary transport is HTTP to the running

13 * `sfdt ui` server on http://127.0.0.1:7654. When that server is not running,

src/commands/ui.jsView file

Lines 40-80javascript

40 } else {

41 print.error(`Failed to start server: ${err.message}`);

42 }

43 process.exitCode = 1;

44 return;

45 }

47 // The dashboard authenticates with a one-time launch token generated fresh

scripts/core/compare-preview-vs-pull.shView file

•path = scripts/core/compare-preview-vs-pull.sh kind = build_helper sizeBytes = 3156 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/core/compare-preview-vs-pull.shView on unpkg