registry / @solidactions/cli / 3.18.0
@solidactions/cli@3.18.0
SolidActions CLI - Deploy and manage workflow automation
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged child-process execution is used by the explicit dev command to load TypeScript workflows, and the package has no install-time hook. Deployment metadata is sent as part of a user-requested deploy; no malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs a CLI command; TypeScript re-execution occurs only for a dev command with a TypeScript entry.
Impact
These operations support the package's stated CLI purpose; no unauthorized credential collection, account action, or unrelated data transfer was identified.
Mechanism
The CLI may invoke npx tsx for that workflow, send deployment archives and source metadata to the configured SolidActions host, and check the package's latest version at the npm registry.
AI rationale
The flagged child-process execution is used by the explicit dev command to load TypeScript workflows, and the package has no install-time hook. Deployment metadata is sent as part of a user-requested deploy; no malicious behavior was identified.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle hook is prepublishOnly, which runs the build; there is no install hook.
- The CLI parses arguments only when run as the executable, so importing its entry point does not start commands.
- The flagged npx tsx invocation is part of the explicit dev workflow command for loading TypeScript entries.
- Without --env, dev performs no platform fetch and starts ctx.vars empty; it does not expose the host process environment to the workflow.
- Git and CI revision metadata is attached to the deployment form when the user deploys.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/utils/source-provenance.jsView file
19const path_1 = __importDefault(require("path"));
L20: const child_process_1 = require("child_process");
L21: const form_data_1 = __importDefault(require("form-data"));
High
Child Process
Package source references child process execution.
dist/utils/source-provenance.jsView on unpkg · L19dist/index.jsView file
40exports.program = void 0;
L41: const chalk_1 = __importDefault(require("chalk"));
L42: const commander_1 = require("commander");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L40dist/commands/dev.jsView file
Findings
1 Critical3 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/dev.js
HighChild Processdist/utils/source-provenance.js
HighRuntime Package Installdist/commands/dev.js
HighSemantic Analysis Limiteddist/commands/deploy.js#virtual:normalized:round1
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @solidactions/cli@3.18.0.
See all versions of @solidactions/cli for other recorded verdicts.
- Review the evidence and your use of @solidactions/cli@3.18.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.