@sortlist/cli@0.38.0
Sortlist platform CLI — GraphQL federation client
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource confirms forwarding of an existing service credential to an unrestricted configured destination through the active launcher. No separate concrete attack evidence supports blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
Run sl with saved credentials and an endpoint override, SL_ENDPOINT, or configured endpoint targeting another recipient, when schema introspection requires a network request.
Impact
The selected endpoint can obtain the user's Sortlist access token.
Mechanism
The CLI loads the saved access token and attaches it to an HTTP request without restricting the selected destination.
AI rationale
Source confirms forwarding of an existing service credential to an unrestricted configured destination through the active launcher. No separate concrete attack evidence supports blocking publication.
Evidence
dist/index.js.sortlist/credentials.json
Network endpoints1
federation.sortlist.com/graphql
Decision evidence
public snapshotAI called this Suspicious at 98.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest has a prepare hook for Git hook setup; the launcher runs the bundled CLI.
- The CLI reads saved credentials and selects their access token for schema introspection.
- Endpoint overrides and SL_ENDPOINT are accepted without destination validation.
- Schema introspection sends the saved token as a bearer credential to the selected endpoint.
- CLI startup passes --endpoint directly into schema introspection before parsing commands.
Evidence against
- The default federation endpoint belongs to Sortlist; no hidden unrelated credential recipient was identified.
- Child processes implement local CLI execution and same-package updates; no concrete malicious install chain was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggedbin/sl.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from 'node:child_process';
L3: import { existsSync, readFileSync } from 'node:fs';
High
1Cross-file remote execution chain: bin/sl.mjs spawns dist/index.js; helper contains network access plus dynamic code execution.
L1: #!/usr/bin/env node
L2: import { execFileSync } from 'node:child_process';
L3: import { existsSync, readFileSync } from 'node:fs';
...
L6:
L7: const __dirname = dirname(fileURLToPath(import.meta.url));
L8: const selfRoot = resolve(__dirname, '..');
...
L11: * Walk upward from `start` looking for a @sortlist/cli checkout
L12: * (package.json with name === "@sortlist/cli" and no .published sentinel).
L13: * Returns the package root, or null.
...
L20: try {
L21: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
L22: if (pkg.name === '@sortlist/cli' && !existsSync(resolve(dir, '.published'))) {
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/sl.mjsView on unpkg · L1package.jsonView file
Findings
3 High3 Medium6 Low
HighChild Processbin/sl.mjs
HighShell
HighCross File Remote Execution Contextbin/sl.mjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @sortlist/cli@0.38.0.
See all versions of @sortlist/cli for other recorded verdicts.
- Review the evidence and your use of @sortlist/cli@0.38.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.