@shipeasy/cli@2.25.0
CLI for the Shipeasy platform (flags, experiments, translations, bugs)
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package silently reports CLI errors to its own service, including command arguments and error text, without a consent step or disclosure in the inspected flow. The collection is a suspicious telemetry risk; the reviewed login flow and process execution otherwise fit the CLI’s purpose.
Static reason
One or more suspicious static signals were detected.
Trigger
A Commander CLI parse error while running the executable.
Impact
Arguments and error messages may contain project or user data that the user did not knowingly submit as a report.
Mechanism
The error handler posts the command, message, sanitized argv, runtime version, and platform to the configured Shipeasy API base at `/cli/errors`; some non-secret-looking arguments pass through unchanged.
AI rationale
The package silently reports CLI errors to its own service, including command arguments and error text, without a consent step or disclosure in the inspected flow. The collection is a suspicious telemetry risk; the reviewed login flow and process execution otherwise fit the CLI’s purpose.
Evidence
dist/index.js
Network endpoints1
api.shipeasy.ai/cli/errors
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- CLI parse errors trigger a reporter with the command, error message, and raw arguments.
- The reporter posts error details and sanitized arguments to the Shipeasy API’s `/cli/errors` endpoint without a consent check.
- Argument sanitization redacts some common secret flags and Shipeasy keys, but passes other arguments through.
Evidence against
- The manifest declares no install, preinstall, or postinstall lifecycle scripts.
- The executable explicitly calls the CLI `run` function; the flagged behavior is in its parse-error handler.
- The login flow uses a browser-approved Shipeasy device flow and stores the resulting Shipeasy session.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
47var import_node_http = __toESM(require("http"));
L48: var import_node_child_process2 = require("child_process");
L49:
High
46var import_node_fs4 = require("fs");
L47: var import_node_http = __toESM(require("http"));
L48: var import_node_child_process2 = require("child_process");
L49:
...
L56: function credentialsPath() {
L57: const xdg = process.env.XDG_CONFIG_HOME;
L58: const root = xdg ? xdg : import_node_path.default.join(import_node_os.default.homedir(), ".config");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L4646var import_node_fs4 = require("fs");
L47: var import_node_http = __toESM(require("http"));
L48: var import_node_child_process2 = require("child_process");
L49:
...
L56: function credentialsPath() {
L57: const xdg = process.env.XDG_CONFIG_HOME;
L58: const root = xdg ? xdg : import_node_path.default.join(import_node_os.default.homedir(), ".config");
L59: return import_node_path.default.join(root, "shipeasy", "config.json");
...
L80: const raw = import_node_fs.default.readFileSync(configPath(), "utf-8");
L81: const parsed = JSON.parse(raw);
L82: if (!parsed.project_id || !parsed.cli_token) return null;
...
L312: );
Findings
6 High4 Medium4 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighHost Fingerprint Exfiltrationdist/index.js
HighCredential Redirect Persistencedist/index.js
HighRuntime Package Installdist/index.js
MediumDynamic Requirebin/shipeasy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @shipeasy/cli@2.25.0.
See all versions of @shipeasy/cli for other recorded verdicts.
- Review the evidence and your use of @shipeasy/cli@2.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.