registry / @slabui/cli / 0.4.0
@slabui/cli@0.4.0
The SlabUI CLI: add, update and compare items from versioned component registries
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe manifest has no install lifecycle scripts, and the flagged process and network capabilities align with the CLI’s stated purpose of managing components and their dependencies. The inspected code shows no unrelated credential collection or concealed automatic execution.
Static reason
One or more suspicious static signals were detected.
Trigger
Users run the CLI commands or call the library’s registry client; the update check is limited to interactive, non-CI CLI use.
Impact
Expected registry access and project dependency installation; no unauthorized collection or account action was found.
Mechanism
The package fetches registry data and performs sign-in against its configured registry. CLI dependency installation supports declared component dependencies.
AI rationale
The manifest has no install lifecycle scripts, and the flagged process and network capabilities align with the CLI’s stated purpose of managing components and their dependencies. The inspected code shows no unrelated credential collection or concealed automatic execution.
Evidence
~/.config/slabui/credentials.jsonproject files selected by CLI commands
Network endpoints2
slabui.comregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares no lifecycle scripts and exposes a library entry point plus the `slabui` CLI.
- The library client fetches registry data using a supplied registry URL and optional SlabUI token.
- CLI update checks are limited to interactive, non-CI runs and can be disabled with `SLABUI_NO_UPDATE_CHECK=1`.
Evidence against
- The package reads and writes a SlabUI credentials file and uses network requests for registry access and sign-in, which match its stated component-registry purpose.
- The CLI includes child-process support for installing npm dependencies declared by registry items.
Behavioral surface
ChildProcessEnvironmentVars
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/index.mjsView file
1import{createHash as e,randomBytes as t}from"node:crypto";import{z as n}from"zod";import{homedir as r,hostname as i}from"node:os";import a from"node:path";import{access as o,lstat ...
L2: `,f.append(_.decl({prop:`--${u}`,value:l,raws:{before:`
High
1import{createHash as e,randomBytes as t}from"node:crypto";import{z as n}from"zod";import{homedir as r,hostname as i}from"node:os";import a from"node:path";import{access as o,lstat ...
L2: `,f.append(_.decl({prop:`--${u}`,value:l,raws:{before:`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.mjsView on unpkg · L11import{createHash as e,randomBytes as t}from"node:crypto";import{z as n}from"zod";import{homedir as r,hostname as i}from"node:os";import a from"node:path";import{access as o,lstat ...
L2: `,f.append(_.decl({prop:`--${u}`,value:l,raws:{before:`
...
L86: `)),`merged`;let g=l?await l(e):`markers`;return g===`local`?`kept`:g===`remote`?(await m(n),`updated`):(await m(h.result.join(`
L87: `)),`conflict`)}async function On({token:e,fetch:t=globalThis.fetch,env:n=process.env,file:r=te(n)}){let i=K(void 0,n),a;try{a=await ie({registryUrl:i.url,token:e,fetch:t,headers:k...
L88: //# sourceMappingURL=index.mjs.map
Findings
3 High2 Medium6 Low
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighSandbox Evasion Gated Capabilitydist/index.mjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.mjs
LowAi Review Evidencedist/cli.mjs
Affected versions and remediation
This report applies to @slabui/cli@0.4.0.
See all versions of @slabui/cli for other recorded verdicts.
- Review the evidence and your use of @slabui/cli@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.