registry / @shopify/cli / 4.8.5
@shopify/cli@4.8.5
A CLI tool to build for the Shopify platform
AI Security Review
scanned 29d ago · by lpm-firewall-aiDirect inspection supports package-aligned CLI behavior rather than the scanner's malicious label. The agent target handles theme documents, and the flagged execution and network operations do not establish an active attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI invocation activates runtime functionality; npm installation has no package lifecycle trigger.
Impact
No confirmed credential exfiltration, covert persistence, or agent control hijacking was established.
Mechanism
The flagged primitives implement machine identification, destination-preserving proxies, GitHub downloads, and ordinary project file operations.
AI rationale
Direct inspection supports package-aligned CLI behavior rather than the scanner's malicious label. The agent target handles theme documents, and the flagged execution and network operations do not establish an active attack.
Evidence
AGENTS.mdDESIGN.md
Network endpoints3
api.github.comgithub.commonorail-edge.shopifysvc.com/v1/produce
Decision evidence
public snapshotAI called this Clean at 85.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no npm install lifecycle hooks or runtime self-dependency.
- The agent integration target lists AGENTS.md among theme files for synchronization; no broad agent configuration mutation was identified.
- dist/chunk-NDFKLPHJ.js discovers Shopify app roots; dist/chunk-PSSOCUUD.js implements terminal UI layout callbacks.
- dist/morph-BMYYMQNX.js saves explicit source edit results through its file system wrapper.
- The flagged command output in dist/chunk-KYNXMDFU.js is parsed for a machine identifier, alongside package-aligned telemetry; no secret theft was established.
- dist/chunk-6QDOCBD4.js preserves the requested host through proxy CONNECT; dist/chunk-HGFCNPSN.js retrieves GitHub release metadata and downloads.
Evidence against
- Large bundled sources limit exhaustive static coverage.
- The legacy src/index.js manifest target is absent; the export and CLI use dist entrypoints.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
17 flaggeddist/chunk-NDFKLPHJ.jsView file
980A related pattern is command injection \u2014 where user input flows into
L981: \`exec()\`, \`system()\`, or shell commands without sanitisation.
L982:
High
Child Process
Package source references child process execution.
dist/chunk-NDFKLPHJ.jsView on unpkg · L9801680`,n)===-1?void 0:t.content.indexOf(`
L1681: `,n)).trim(),fix:{automated:!1,description:r}}}m();import{spawn as Rn}from"node:child_process";import{existsSync as ui}from"node:fs";import{tmpdir as li}from"node:os";import{lstat ...
L1682: `))try{return n.split(`
High
1import{F as It,G as Rt,H as Ct}from"./chunk-AI4SPBPV.js";import{aa as as}from"./chunk-MFP63IUM.js";import{a as fe}from"./chunk-4QBJ5JBX.js";import{a as B,v as A}from"./chunk-KYNXMD...
L2: id: APP_PROXY_LIQUID_INJECTION
...
L20: App proxies let an app serve content directly on the merchant's store
L21: via a URL like \`https://shop.example.com/apps/my-app/proxy\`. Shopify
L22: signs every proxy request with an HMAC using the app's shared secret.
...
L145: - Remix: \`action\` exports in route files
L146: - Express: \`app.post()\`, \`app.put()\`, \`app.delete()\`
L147: - PHP: form handlers, POST routes
...
L980: A related pattern is command injection \u2014 where user input flows into
L981: \`exec()\`, \`system()\`, or shell commands without sanitisation.
L982:
...
L1647: `;m();var je=[{
Findings
1 Critical10 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/chunk-HGFCNPSN.js
HighChild Processdist/chunk-NDFKLPHJ.js
HighShelldist/chunk-NDFKLPHJ.js
HighSame File Env Network Executiondist/chunk-PSSOCUUD.js
HighCommand Output Exfiltrationdist/chunk-PSSOCUUD.js
HighSandbox Evasion Gated Capabilitydist/chunk-NDFKLPHJ.js
HighCloud Metadata Accessdist/chunk-NDFKLPHJ.js
HighObfuscated Payload Loaderdist/morph-BMYYMQNX.js
HighCross File Remote Execution Contextdist/chunk-KYNXMDFU.js
HighTrigger Reachable Command Output Exfiltrationdist/chunk-KYNXMDFU.js
HighSemantic Analysis Limiteddist/chunk-6QDOCBD4.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @shopify/cli@4.8.5.
See all versions of @shopify/cli for other recorded verdicts.
- Review the evidence and your use of @shopify/cli@4.8.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.