@shopify/cli@4.8.3
A CLI tool to build for the Shopify platform
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource supports a warning for conditional forwarding of an existing service credential to an unrestricted configured destination. It does not establish malicious intent or a publish-blocking attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run the Hydrogen deployment command with UNSAFE_SHOPIFY_HYDROGEN_DEPLOYMENT_URL set and a linked storefront token available.
Impact
An operator-selected endpoint could receive a credential intended for Shopify Oxygen.
Mechanism
The override replaces the service URL without a host allowlist; the GraphQL client sends the deployment access token in authentication headers.
AI rationale
Source supports a warning for conditional forwarding of an existing service credential to an unrestricted configured destination. It does not establish malicious intent or a publish-blocking attack.
Evidence
dist/chunk-4CLJ6W23.jsdist/chunk-IAURXPUJ.js
Network endpoints1
oxygen.shopifyapps.com
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Deployment code can obtain the linked storefront's Oxygen deployment token automatically.
- UNSAFE_SHOPIFY_HYDROGEN_DEPLOYMENT_URL overrides the intended Oxygen service destination.
- Deployment URL validation checks URL format without restricting the destination host.
- The deployment request forwards the access token through authentication headers to the selected URL and executes a GraphQL request.
- The behavior activates through the user-invoked Hydrogen deployment command.
Evidence against
- The custom destination requires an explicit environment override and emits a warning.
- The default destination is Shopify's Oxygen service.
- package.json has no npm install lifecycle hooks or runtime self-dependency; no covert credential export was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
17 flaggeddist/chunk-T3IMDY72.jsView file
237`),S}function B2(n,u){let c=`${u.cwd}${Qy}${process.env.PATH}`,r=Fy.default.sync(n,{nothrow:!0,path:c});if(r&&hy(r)===u.cwd){let E=["Skipped run of unsecure binary",{command:n},"fo...
L238: `+z.replace(/^Error(:[^\n]*)?\n/,""))});return G.prototype=Object.create(D.prototype),G.prototype.constructor=G,G.prototype.toString=function(){return this.message===void 0?this.na...
L239: `))u=Math.max(u,Oi(c));return u}var TS=new Map,eN=n=>{if(n.length===0)return{width:0,height:0};let u=TS.get(n);if(u)return u;let c=kB(n),r=n.split(`
High
Child Process
Package source references child process execution.
dist/chunk-T3IMDY72.jsView on unpkg · L237233`),d=Math.max.apply(null,E.map(Q=>Q.length).concat([u.stops.length])),m=lR(u,r,d),S=[];for(let Q of E){let U=m.slice(0),b="";for(let X of Q)b+=aR.hex(U.shift().toHex())(X);S.push(b...
L234: `)}function uR(n){let u={interpolation:"rgb",hsvSpin:"short",...n};if(n!==void 0&&typeof n!="object")throw new TypeError(`Expected \`options\` to be an \`object\`, got \`${typeof n...
L235: \xB7 Command: ${n} ${u.join(" ")}
L236: \xB7 Working directory: ${d}
L237: `),S}function B2(n,u){let c=`${u.cwd}${Qy}${process.env.PATH}`,r=Fy.default.sync(n,{nothrow:!0,path:c});if(r&&hy(r)===u.cwd){let E=["Skipped run of unsecure binary",{command:n},"fo...
L238: `+z.replace(/^Error(:[^\n]*)?\n/,""))});return G.prototype=Object.create(D.prototype),G.prototype.constructor=G,G.prototype.toString=function(){retur
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical10 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/chunk-BJ3JF35I.js
HighChild Processdist/chunk-T3IMDY72.js
HighShelldist/chunk-4CLJ6W23.js
HighSame File Env Network Executiondist/chunk-T3IMDY72.js
HighCommand Output Exfiltrationdist/chunk-T3IMDY72.js
HighSandbox Evasion Gated Capabilitydist/chunk-QCMGYBFD.js
HighCloud Metadata Accessdist/chunk-RAJX2CQP.js
HighObfuscated Payload Loaderdist/morph-BMYYMQNX.js
HighCross File Remote Execution Contextdist/chunk-IAURXPUJ.js
HighTrigger Reachable Command Output Exfiltrationdist/chunk-IAURXPUJ.js
HighSemantic Analysis Limiteddist/chunk-6QDOCBD4.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @shopify/cli@4.8.3.
See all versions of @shopify/cli for other recorded verdicts.
- Review the evidence and your use of @shopify/cli@4.8.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.