@shopify/cli@4.8.4
A CLI tool to build for the Shopify platform
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source establishes token forwarding to an unrestricted configured deployment endpoint through an explicit CLI command. The opt-in override prevents treating this as covert theft, but does not prevent exposure of an automatically obtained service credential.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run shopify hydrogen deploy with UNSAFE_SHOPIFY_HYDROGEN_DEPLOYMENT_URL set, using a linked storefront without supplying a replacement token.
Impact
The configured endpoint can receive a token intended for Oxygen deployment.
Mechanism
The deployment workflow substitutes the configured URL without a Shopify destination allowlist, then sends the deployment token in authenticated GraphQL requests.
AI rationale
Inspected source establishes token forwarding to an unrestricted configured deployment endpoint through an explicit CLI command. The opt-in override prevents treating this as covert theft, but does not prevent exposure of an automatically obtained service credential.
Evidence
dist/chunk-TAY7HU7X.jsdist/chunk-CNK3ZO2B.js
Network endpoints1
oxygen.shopifyapps.com
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit Hydrogen deployment command invokes the deployment workflow.
- Without a caller-supplied token, interactive deployment retrieves and uses the linked storefront's Oxygen deployment token.
- UNSAFE_SHOPIFY_HYDROGEN_DEPLOYMENT_URL overrides the recipient; URL validation does not restrict it to Shopify hosts.
- Build initiation sends the deployment access token to the selected endpoint's GraphQL API.
- The GraphQL client attaches token-derived headers and executes the request against the supplied URL.
- The indicated AGENTS.md location is a theme file watch pattern, not an agent configuration installation hook.
Evidence against
- No npm install lifecycle hooks or runtime self-dependency appear in package.json.
- The custom endpoint requires an explicit environment override and emits a warning.
- No covert credential theft or malicious intent was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEval
Source & flagged code
17 flaggeddist/chunk-CNK3ZO2B.jsView file
176`);return(A.length===1||A.length===2&&/at Error \(native\)/.test(A[1]))&&(m.stack=A[0]+`
L177: `+T),m};var Qd={},sle=Ou.getStack;Qd={name:"contextualize",load:function(m){var T=function(A,h){var g=sle(),x=Oy(m);return x.fallbackStack=g,x.addOnError(h),m._clientContext.run(x,...
L178: `).find(o=>o.includes("IOPlatformUUID"));if(!e)return"";let r=e.split('" = "');if(r.length===2)return r[1].slice(0,-1)}catch(t){pMe.diag.debug(`error reading machine id: ${t}`)}ret...
High
Child Process
Package source references child process execution.
dist/chunk-CNK3ZO2B.jsView on unpkg · L176162`).filter(function(u){return!!u.match(r)&&!u.match(/^Error created at/)},this);return n.map(function(u){var c=u.split("@"),p=this.extractLocation(c.pop()),f=c.shift()||"",y=f.repla...
L163: `&&o.shift(),this._lineBuffer.length>0&&(this._lineBuffer[this._lineBuffer.length-1]+=o[0],o.shift()),this._lastChunkEndedWithCR=t[t.length-1]=="\r",this._lineBuffer=this._lineBuff...
L164: `+se(y(m),function(h){return" - "+h+" "+m[h]+", got "+$ce(T[h])}).join(`
...
L176: `);return(A.length===1||A.length===2&&/at Error \(native\)/.test(A[1]))&&(m.stack=A[0]+`
L177: `+T),m};var Qd={},sle=Ou.getStack;Qd={name:"contextualize",load:function(m){var T=function(A,h){var g=sle(),x=Oy(m);return x.fallbackStack=g,x.addOnError(h),m._clientContext.run(x,...
L178: `).find(o=>o.includes("IOPlatformUUID"));if(!
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
1 Critical10 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/chunk-6QADNGH4.js
HighChild Processdist/chunk-CNK3ZO2B.js
HighShelldist/chunk-TAY7HU7X.js
HighSame File Env Network Executiondist/chunk-CNK3ZO2B.js
HighCommand Output Exfiltrationdist/chunk-CNK3ZO2B.js
HighSandbox Evasion Gated Capabilitydist/chunk-XYUTD6IU.js
HighCloud Metadata Accessdist/chunk-MBRFIXCU.js
HighObfuscated Payload Loaderdist/morph-BMYYMQNX.js
HighCross File Remote Execution Contextdist/chunk-CNK3ZO2B.js
HighTrigger Reachable Command Output Exfiltrationdist/chunk-6C5AVMKR.js
HighSemantic Analysis Limiteddist/chunk-6QDOCBD4.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @shopify/cli@4.8.4.
See all versions of @shopify/cli for other recorded verdicts.
- Review the evidence and your use of @shopify/cli@4.8.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.