registry / @shopify/cli / 5.0.0
@shopify/cli@5.0.0
⚠ Under reviewA CLI tool to build for the Shopify platform
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe flagged command-output behavior resolves to terminal-size detection, and the package manifest has no install lifecycle hook. Reachable generated bundles remain materially unresolved, so the source review cannot support a clean verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running the Shopify CLI invokes its bundled runtime.
Impact
The unresolved code leaves runtime behavior uncertain; no harmful effect was confirmed.
Mechanism
The CLI entrypoint imports large generated bundles that this review could not fully resolve.
AI rationale
The flagged command-output behavior resolves to terminal-size detection, and the package manifest has no install lifecycle hook. Reachable generated bundles remain materially unresolved, so the source review cannot support a clean verdict.
Evidence
dist/chunk-IGE4Y5SE.jsdist/morph-CRY35DIK.jsdist/chunk-H4V55Y3Z.jsdist/chunk-3G4HJO72.js
Decision evidence
public snapshotAI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest defines the CLI entrypoints and has no package install lifecycle script.
- The flagged command-output helper runs terminal-size queries and parses their numeric results as dimensions.
- The reviewed runtime excerpts concern CLI diagnostics, cookie and header handling, Liquid validation, theme deletion and checksum errors, and app-log resubscription.
- The CLI bundle imports several very large generated files whose behavior remains unresolved in this review.
Evidence against
- Material portions of reachable generated bundles were not resolved, so the review cannot certify that all runtime behavior is benign.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetry
Source & flagged code
18 flaggeddist/chunk-KKPOOIE4.jsView file
1import{a as N,b as $,c as g}from"./chunk-Q2XRITUG.js";import{j as D}from"./chunk-H4V55Y3Z.js";import{a as b,b as A}from"./chunk-GRGFA26K.js";import{T as p,U as k,a as T}from"./chun...
L2: `);s===""?this.currentStatus={status:"error",message:"Could not start Cloudflare tunnel: unknown error.",tryMessage:d()}:this.currentStatus={status:"error",message:s,tryMessage:d()...
High
Child Process
Package source references child process execution.
dist/chunk-KKPOOIE4.jsView on unpkg · L1dist/chunk-WBJ6ZHYH.jsView file
4`),g=`${i?"Caused by: ":""}${y}`;g=(0,qd.default)(g,Fd.errtermwidth-6,{hard:!0,trim:!1}),ho.settings.debug||(g=(0,xn.default)(g,3),g=(0,xn.default)(g,1,{includeEmptyLines:!0,indent...
L5: `)}});var mt=m(be=>{"use strict";u();var kd=be&&be.__createBinding||(Object.create?(function(n,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!...
L6: `&&this._write(t,`
High
Findings
1 Critical10 High8 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/chunk-LWCTKI4Z.js
HighChild Processdist/chunk-KKPOOIE4.js
HighShelldist/chunk-WBJ6ZHYH.js
HighSame File Env Network Executiondist/chunk-IGE4Y5SE.js
HighCommand Output Exfiltrationdist/chunk-IGE4Y5SE.js
HighSandbox Evasion Gated Capabilitydist/chunk-3A3DZVEJ.js
HighCloud Metadata Accessdist/chunk-LMQGNECW.js
HighObfuscated Payload Loaderdist/morph-CRY35DIK.js
HighCross File Remote Execution Contextdist/chunk-H4V55Y3Z.js
HighTrigger Reachable Command Output Exfiltrationdist/chunk-CZ22VZDA.js
HighSemantic Analysis Limiteddist/chunk-7UOA4DI7.js#virtual:string-array:round1
Affected versions and remediation
This report applies to @shopify/cli@5.0.0.
See all versions of @shopify/cli for other recorded verdicts.
- Review the evidence and your use of @shopify/cli@5.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.