registry / @teambit/cli / 0.0.1418
@teambit/cli@0.0.1418
⚠ Under reviewAI Security Review
scanned 14d ago · by lpm-firewall-aiThe inspected package code shows ordinary CLI behavior and no confirmed attack. Several selected runtime dependency sources remain unavailable or unresolved, which prevents a clean verdict under the review policy.
Static reason
No blocking static signals were detected.
Trigger
Using the CLI loads runtime dependencies.
Impact
The behavior of those dependencies remains unverified, so this package cannot be cleared from the inspected source alone.
Mechanism
The package manifest declares dependencies, and CLI modules import them; some selected dependency sources could not be reviewed.
AI rationale
The inspected package code shows ordinary CLI behavior and no confirmed attack. Several selected runtime dependency sources remain unavailable or unresolved, which prevents a clean verdict under the review policy.
Evidence
package.jsondist/cli-parser.jsdist/cli.main.runtime.js
Decision evidence
public snapshotAI called this Manual Review at 86.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares runtime dependencies that could not be fully source-reviewed.
- The CLI imports lodash and p-map-series at runtime, so the unresolved dependency scope is reachable.
- Inspected pager code uses the configured pager and passes it output; this alone does not establish an attack.
Evidence against
- The inspected didyoumean source implements string matching, and its manifest points to that file as its entry point.
- No concrete attack behavior was identified in the inspected package source.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
14"lodash": "4.18.1",
"yargs": "17.0.1",
"p-map-series": "2.1.0",
"fs-extra": "10.0.0",
"pad-right": "0.2.2",
"@teambit/legacy.loader": "0.0.34",
"@teambit/le
Low
Suspicious Dependency Evidence
The manifest declares runtime dependencies that could not be fully source-reviewed.
package.jsonView on unpkg · L14dist/cli-parser.jsView file
23const data = require("lodash");
_lodash = function () {
return data;
};
return data;
}
function _legacy() {
const data = require("@teambit/legacy.consumer");
_legacy
Low
Suspicious Dependency Evidence
The CLI imports lodash and p-map-series at runtime, so the unresolved dependency scope is reachable.
dist/cli-parser.jsView on unpkg · L23dist/cli.main.runtime.jsView file
Findings
1 Medium10 Low
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidencedist/cli-parser.js
LowSuspicious Dependency Evidencedist/cli.main.runtime.js
LowAi Review Evidencedist/pager.js
LowSuspicious Dependency Evidence.lpm-dependency-evidence-dfbf2f21-41f8-4503-b01d-b32141dd9d85/0/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-dfbf2f21-41f8-4503-b01d-b32141dd9d85/1/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-dfbf2f21-41f8-4503-b01d-b32141dd9d85/1/npm-linux/didYouMean-1.2.1.js
Affected versions and remediation
This report applies to @teambit/cli@0.0.1418.
See all versions of @teambit/cli for other recorded verdicts.
- Review the evidence and your use of @teambit/cli@0.0.1418 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.