registry / @teambit/cli / 0.0.1426
@teambit/cli@0.0.1426
⚠ Under reviewAI Security Review
scanned 8d ago · by lpm-firewall-aiThe inspected manifest and runtime code establish ordinary CLI behavior and no confirmed attack. Several declared runtime dependencies have no verified source in this snapshot, so the risk remains unresolved and warrants manual review.
Static reason
No blocking static signals were detected.
Trigger
Using the CLI activates its runtime and selected command; paging occurs when the output path invokes the pager.
Impact
No attack impact is confirmed; behavior in unverified dependencies cannot be assessed from this snapshot.
Mechanism
The pager uses the configured pager command, and command startup initializes analytics with the token flag redacted. Other declared runtime dependencies remain unverified.
AI rationale
The inspected manifest and runtime code establish ordinary CLI behavior and no confirmed attack. Several declared runtime dependencies have no verified source in this snapshot, so the risk remains unresolved and warrants manual review.
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest has no install lifecycle hook and declares the package entrypoint and runtime dependencies.
- The pager launches a command selected from the user's pager environment settings.
- Command startup initializes analytics with flags after redacting the token flag.
- The inspected runtime processes registered startup callbacks and then runs the selected CLI command.
Evidence against
- The inspected files show no confirmed malicious behavior; several runtime dependencies could not be verified from the available source snapshot.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
11"dependencies": {
"chalk": "4.1.2",
"didyoumean": "1.2.1",
"lodash": "4.18.1",
"yargs": "17.0.1",
"p-map-series": "2.1.0",
"fs-extra": "10.0.0",
"pad-right": "0.2.2",
"@teambit/legacy.loader": "0.0.34",
"@teambit/legacy.logger": "0.0.71",
"@teambit/harmony.modules.runtimes": "0.0.4",
"@teambit/harmony": "0.4.12",
"@teambit/bit.get-bit-version": "0.0.31",
"@teambit
Low
Suspicious Lifecycle Evidence
The manifest has no install lifecycle hook and declares the package entrypoint and runtime dependencies.
package.jsonView on unpkg · L11dist/pager.jsView file
154const configuredPager = process.env.BIT_PAGER ?? process.env.PAGER ?? 'less';
const tokens = parsePagerCommand(configuredPager);
// an empty / "cat" pager means the user disabled paging. honor that, unless `--pager` forces
// paging on, in which case fall back to a real pager so the flag is a true override.
const disabled = !tokens[0] || tokens[0] === 'cat';
if (disabled && !force) {
res
Low
Ai Review Evidence
The pager launches a command selected from the user's pager environment settings.
dist/pager.jsView on unpkg · L154Findings
1 Medium7 Low
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/pager.js
LowAi Review Evidencedist/command-runner.js
LowAi Review Evidencedist/cli.main.runtime.js
Affected versions and remediation
This report applies to @teambit/cli@0.0.1426.
See all versions of @teambit/cli for other recorded verdicts.
- Review the evidence and your use of @teambit/cli@0.0.1426 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.