registry / @teambit/cli / 0.0.1425
@teambit/cli@0.0.1425
⚠ Under reviewAI Security Review
scanned 9d ago · by lpm-firewall-aiThe inspected source shows an analytics initialization call with redacted flags, but the selected first-party dependency implementation was unresolved. This leaves runtime behavior unverified, so manual review is appropriate.
Static reason
No blocking static signals were detected.
Trigger
Running a CLI command reaches command setup and calls analytics initialization.
Impact
The dependency's runtime effects are unknown, so this review cannot establish whether the call is benign or harmful.
Mechanism
The runner passes command data and redacted flags to the analytics dependency; its implementation could not be assessed.
AI rationale
The inspected source shows an analytics initialization call with redacted flags, but the selected first-party dependency implementation was unresolved. This leaves runtime behavior unverified, so manual review is appropriate.
Evidence
package.jsondist/command-runner.js
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares first-party runtime dependencies including the analytics package.
- The command runner imports that analytics package and calls its initialization during command setup, passing redacted flags.
- The runner also invokes logger setup; the inspected source does not establish what the unresolved dependency implementations do.
Evidence against
- The inspected runner passes redacted flags to analytics initialization; no credential transfer or unrelated network recipient was established.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggedpackage.jsonView file
26"@teambit/legacy.consumer": "0.0.194",
"@teambit/legacy.logger": "0.0.71",
"@teambit/logger": "0.0.1502",
"@teambit/legacy.analytics": "0.0.117",
"@teambit/legacy.cli.error": "0.0.72"
},
"devDependencies": {
"@types/didyou
Low
Suspicious Dependency Evidence
The manifest declares first-party runtime dependencies including the analytics package.
package.jsonView on unpkg · L26dist/command-runner.jsView file
48return data;
}
function _legacy4() {
const data = require("@teambit/legacy.analytics");
_legacy4 = function () {
return
Low
Ai Review Evidence
The command runner imports that analytics package and calls its initialization during command setup, passing redacted flags.
dist/command-runner.jsView on unpkg · L48122const redactedFlags = this.getRedactedFlagsForReporting();
try {
_legacy4().Analytics.init(this.commandName, redactedFlags, this.args);
} catch (err) {
// ignoring the error, we don't want to fail
Findings
1 Medium6 Low
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowAi Review Evidencedist/command-runner.js
LowAi Review Evidencedist/command-runner.js
Affected versions and remediation
This report applies to @teambit/cli@0.0.1425.
See all versions of @teambit/cli for other recorded verdicts.
- Review the evidence and your use of @teambit/cli@0.0.1425 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.