registry / @teambit/cli / 0.0.1419
@teambit/cli@0.0.1419
⚠ Under reviewAI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected package source shows analytics initialization with redacted flags, but does not include the invoked analytics implementation. Because selected runtime dependency behavior remains unresolved, the package cannot be marked clean from this inspection.
Static reason
No blocking static signals were detected.
Trigger
Running a CLI command invokes the command runner.
Impact
The available source does not establish what data the external implementation sends or how it handles it, so the review remains incomplete.
Mechanism
The runner initializes an external analytics implementation with command details; that implementation could not be assessed from the package source.
AI rationale
The inspected package source shows analytics initialization with redacted flags, but does not include the invoked analytics implementation. Because selected runtime dependency behavior remains unresolved, the package cannot be marked clean from this inspection.
Evidence
package.jsondist/command-runner.js
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares third-party runtime dependencies, including the logger and analytics packages.
- The command runner loads the logger and loader dependencies and initializes analytics with redacted flags when a command runs.
- The analytics implementation is outside the inspected package source, so its data handling could not be assessed.
Evidence against
- No concrete attack behavior was identified in the inspected package source.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggedpackage.jsonView file
11"dependencies": {
"chalk": "4.1.2",
"didyoumean": "1.2.1",
"lodash": "4.18.1",
"yargs": "17.0.1",
"p-map-series": "2.1.0",
"fs-extra": "10.0.0",
"pad-right": "0.2.2",
"@teambit/legacy.loader": "0.0.34",
"@teambit/legacy.logger": "0.0.69",
"@teambit/harmony.modules.runtimes": "0.0.4",
"@teambit/harmony": "0.4.12",
Low
Suspicious Dependency Evidence
The manifest declares third-party runtime dependencies, including the logger and analytics packages.
package.jsonView on unpkg · L11dist/command-runner.jsView file
8function _legacy() {
const data = require("@teambit/legacy.logger");
_legacy = function () {
return data;
};
return data;
}
function _legacy2() {
const data = require("@teambit/legacy.loader");
_legacy2 = function
Low
Suspicious Dependency Evidence
The command runner loads the logger and loader dependencies and initializes analytics with redacted flags when a command runs.
dist/command-runner.jsView on unpkg · L8Findings
1 Medium6 Low
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidencedist/command-runner.js
LowSuspicious Dependency Evidencedist/command-runner.js
Affected versions and remediation
This report applies to @teambit/cli@0.0.1419.
See all versions of @teambit/cli for other recorded verdicts.
- Review the evidence and your use of @teambit/cli@0.0.1419 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.