@sortlist/cli@0.40.0
Sortlist platform CLI — GraphQL federation client
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource proves conditional forwarding of saved service credentials to an unrestricted endpoint, warranting a warning under the credential-forwarding policy. The lifecycle and child-process findings do not establish a malicious installation chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Run the CLI with saved credentials and an unrelated --endpoint or SL_ENDPOINT destination when schema introspection requires a request.
Impact
The selected destination can receive and potentially reuse the saved access token.
Mechanism
Startup reads the saved access token and attaches it to an introspection POST without validating the endpoint against the credential's intended service.
AI rationale
Source proves conditional forwarding of saved service credentials to an unrestricted endpoint, warranting a warning under the credential-forwarding policy. The lifecycle and child-process findings do not establish a malicious installation chain.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has a prepare hook for Git hook configuration; the launcher runs the bundled CLI through Node.
- The runtime reads saved credentials and selects their access token for schema introspection.
- Endpoint selection accepts a command-line override or SL_ENDPOINT without restricting the destination.
- Schema introspection sends the saved token as a Bearer authorization header to the selected endpoint.
- CLI startup invokes schema introspection using the endpoint override, exposing credentials conditionally when an unrelated destination is selected.
Evidence against
- Default federation endpoints belong to Sortlist; no hidden unrelated credential recipient was identified.
- Child processes support local CLI execution, browser opening, and updates of the same npm package.
- No preinstall, install, or postinstall hook or runtime self-dependency was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
3 flaggedbin/sl.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from 'node:child_process';
L3: import { existsSync, readFileSync } from 'node:fs';
High
1Cross-file remote execution chain: bin/sl.mjs spawns dist/index.js; helper contains network access plus dynamic code execution.
L1: #!/usr/bin/env node
L2: import { execFileSync } from 'node:child_process';
L3: import { existsSync, readFileSync } from 'node:fs';
...
L6:
L7: const __dirname = dirname(fileURLToPath(import.meta.url));
L8: const selfRoot = resolve(__dirname, '..');
...
L11: * Walk upward from `start` looking for a @sortlist/cli checkout
L12: * (package.json with name === "@sortlist/cli" and no .published sentinel).
L13: * Returns the package root, or null.
...
L20: try {
L21: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
L22: if (pkg.name === '@sortlist/cli' && !existsSync(resolve(dir, '.published'))) {
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/sl.mjsView on unpkg · L1package.jsonView file
29"prepare": "[ -n \"$CI\" ] && exit 0; command -v git >/dev/null 2>&1 && git config --unset core.hooksPath || true; command -v lefthook >/dev/null 2>&1 && lefthook install || true"
},
"dependencies": {
"@graphql-typed-document-node/core": "^3.2.0",
"@sentry/n
Medium
Ai Review Evidence
The manifest has a prepare hook for Git hook configuration; the launcher runs the bundled CLI through Node.
package.jsonView on unpkg · L29Findings
3 High3 Medium6 Low
HighChild Processbin/sl.mjs
HighShell
HighCross File Remote Execution Contextbin/sl.mjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencepackage.json
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @sortlist/cli@0.40.0.
See all versions of @sortlist/cli for other recorded verdicts.
- Review the evidence and your use of @sortlist/cli@0.40.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.