@sortlist/cli@0.42.0
Sortlist platform CLI — GraphQL federation client
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource confirms forwarding of an existing service credential to an unrestricted operator-selected destination. This warrants a warning for dangerous capability, without evidence supporting a malware block.
Static reason
One or more suspicious static signals were detected.
Trigger
Run sl with saved credentials and an endpoint override, when schema discovery needs a network request.
Impact
A selected unrelated server could obtain the user's Sortlist bearer token.
Mechanism
The CLI loads the saved access token and places it in the Authorization header of a POST to the selected endpoint without restricting its destination.
AI rationale
Source confirms forwarding of an existing service credential to an unrestricted operator-selected destination. This warrants a warning for dangerous capability, without evidence supporting a malware block.
Evidence
dist/index.js.sortlist/credentials.json
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI reads saved credentials from the user's .sortlist/credentials.json file.
- Endpoint selection accepts command-line and environment overrides without destination validation.
- Schema discovery obtains the saved access token and sends it as a bearer credential to the selected endpoint.
- Startup processes --endpoint and performs schema discovery before command dispatch.
- The launcher executes the packaged CLI; the manifest's prepare hook configures Git hooks.
Evidence against
- No hidden unrelated credential recipient or concrete malware chain was identified.
- Child processes support CLI launch, browser opening, and updates of the same package.
- The Git hook setup uses prepare rather than preinstall, install, or postinstall.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedbin/sl.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from 'node:child_process';
L3: import { existsSync, readFileSync } from 'node:fs';
High
1Cross-file remote execution chain: bin/sl.mjs spawns dist/index.js; helper contains network access plus dynamic code execution.
L1: #!/usr/bin/env node
L2: import { execFileSync } from 'node:child_process';
L3: import { existsSync, readFileSync } from 'node:fs';
...
L6:
L7: const __dirname = dirname(fileURLToPath(import.meta.url));
L8: const selfRoot = resolve(__dirname, '..');
...
L11: * Walk upward from `start` looking for a @sortlist/cli checkout
L12: * (package.json with name === "@sortlist/cli" and no .published sentinel).
L13: * Returns the package root, or null.
...
L20: try {
L21: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
L22: if (pkg.name === '@sortlist/cli' && !existsSync(resolve(dir, '.published'))) {
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/sl.mjsView on unpkg · L1dist/index.jsView file
Findings
2 High4 Medium6 Low
HighChild Processbin/sl.mjs
HighCross File Remote Execution Contextbin/sl.mjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/index.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @sortlist/cli@0.42.0.
See all versions of @sortlist/cli for other recorded verdicts.
- Review the evidence and your use of @sortlist/cli@0.42.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.