registry / @shopify/cli / 4.9.0
@shopify/cli@4.9.0
A CLI tool to build for the Shopify platform
AI Security Review
scanned 22d ago · by lpm-firewall-aiSource inspection found no install hook or concrete malicious behavior. The scanner hints resolve to package-aligned CLI functionality and bundled library code, so the package is clean.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No malicious trigger was identified; the CLI runs through its declared entrypoint when invoked.
Impact
No confirmed harmful effect was established.
Mechanism
The inspected code handles archive paths, theme files, CLI telemetry settings, and bundled libraries; it does not establish an unauthorized action or data transfer.
AI rationale
Source inspection found no install hook or concrete malicious behavior. The scanner hints resolve to package-aligned CLI functionality and bundled library code, so the package is clean.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares the CLI entrypoints and ordinary build, lint, and type-check scripts; it has no npm install lifecycle hook.
- The archive extraction code validates paths and checks link destinations against the extraction root. The flagged account-action locations are in this archive code and a text-diff implementation.
- The AGENTS.md match is one pattern in a list of Shopify theme files to inspect. The adjacent cookie code retains cookies received from a response in the session.
- The bundle configures error reporting for Shopify service endpoints, and the CLI settings code exposes analytics opt-out checks.
- The machine-ID helpers are local readers, while the dynamic function constructor is associated with the explicit YAML js/function tag; no inspected source established an attack transfer or hostile activation path.
- The remaining cited chunks contain CLI app-security and theme-processing code or bundled React, WebSocket, and diff utilities; their inspected excerpts show no concrete attack behavior.
Evidence against
Behavioral surface
Source & flagged code
17 flaggeddist/chunk-VFP3PUGZ.jsView file
150See more help with --help`,Ym.default.getInstance().get("exitCodes")?.failedFlagParsing&&(g.oclif={exit:Ym.default.getInstance().get("exitCodes")?.failedFlagParsing}),g}},r=f=>{if(...
L151: `)}}xF();O.Args=vr(Gc());O.ux=vr(Li());var wF=zn();Object.defineProperty(O,"flush",{enumerable:!0,get:function(){return wF.flush}});var fg=Ap();Object.defineProperty(O,"stderr",{en...
L152: `+s).replace(a,u+`
High
Child Process
Package source references child process execution.
dist/chunk-VFP3PUGZ.jsView on unpkg · L1509`),tl.config.errorLogger&&tl.config.errorLogger.log(r?.stack??"")}else throw r}Oe.error=nl;Oe.default=nl});var _o=E(wn=>{"use strict";y();Object.defineProperty(wn,"__esModule",{val...
L10: `),El.config.errorLogger&&El.config.errorLogger.log(t?.stack??"")}xt.warn=To;var Dl=new Set;function Ov(e){Dl.has(e)||To(e),Dl.add(e)}xt.memoizedWarn=Ov;xt.default=To});var Tl=E(Tr...
L11: `,h+=this.indent(this.wrap(d.trim(),r.indentation+2),4)),h+=`
High
9`),tl.config.errorLogger&&tl.config.errorLogger.log(r?.stack??"")}else throw r}Oe.error=nl;Oe.default=nl});var _o=E(wn=>{"use strict";y();Object.defineProperty(wn,"__esModule",{val...
L10: `),El.config.errorLogger&&El.config.errorLogger.log(t?.stack??"")}xt.warn=To;var Dl=new Set;function Ov(e){Dl.has(e)||To(e),Dl.add(e)}xt.memoizedWarn=Ov;xt.default=To});var Tl=E(Tr...
L11: `,h+=this.indent(this.wrap(d.trim(),r.indentation+2),4)),h+=`
Findings
1 Critical10 High7 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/chunk-GQZPGTG7.js
HighChild Processdist/chunk-VFP3PUGZ.js
HighShelldist/chunk-VFP3PUGZ.js
HighSame File Env Network Executiondist/chunk-L5XWYTHY.js
HighCommand Output Exfiltrationdist/chunk-L5XWYTHY.js
HighSandbox Evasion Gated Capabilitydist/chunk-SGBLCVUX.js
HighCloud Metadata Accessdist/chunk-YX5GRXRS.js
HighObfuscated Payload Loaderdist/morph-42EXMN3K.js
HighCross File Remote Execution Contextdist/chunk-L5XWYTHY.js
HighTrigger Reachable Command Output Exfiltrationdist/chunk-L5XWYTHY.js
HighSemantic Analysis Limiteddist/chunk-7Y7AZRL3.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @shopify/cli@4.9.0.
See all versions of @shopify/cli for other recorded verdicts.
- Review the evidence and your use of @shopify/cli@4.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.