registry / @teambit/cli / 0.0.1430
@teambit/cli@0.0.1430
⚠ Under reviewAI Security Review
scanned 7d ago · by lpm-firewall-aiThe inspected source supports ordinary CLI parsing and user-configured paging, with no confirmed attack behavior. Selected runtime dependencies remain source-unverified, so the package cannot be marked clean from this review.
Static reason
No blocking static signals were detected.
Trigger
Using the CLI loads its declared runtime dependencies; paging starts when CLI output is sent to the configured pager.
Impact
No harmful effect was confirmed; unresolved dependency behavior prevents a clean determination.
Mechanism
The CLI parser imports yargs, while the pager starts the command selected through BIT_PAGER or PAGER, defaulting to less.
AI rationale
The inspected source supports ordinary CLI parsing and user-configured paging, with no confirmed attack behavior. Selected runtime dependencies remain source-unverified, so the package cannot be marked clean from this review.
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares runtime dependencies including yargs and several Bit packages; the CLI parser loads yargs at runtime.
- The pager code uses the configured BIT_PAGER or PAGER command, with less as the default; this is a user-configured CLI feature.
- Several selected runtime dependencies could not be source-verified in the bounded review, so their behavior remains unresolved.
Evidence against
- The inspected source shows no confirmed malicious behavior; the pager subprocess follows the configured pager setting.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggedpackage.jsonView file
11"dependencies": {
"chalk": "4.1.2",
"didyoumean": "1.2.1",
"lodash": "4.18.1",
"yargs": "17.0.1",
"p-map-series": "2.1.0",
"fs-extra": "10.0.0",
"pad-right": "0.2.2",
"@teambit/legacy.loader": "0.0.34",
"@teambit/legacy.logger": "0.0.71",
"@teambit/harmony.modules.runtimes": "0.0.4",
"@teambit/harmony": "0.4.12",
"@teambit/bit.get-bit-version": "0.0.31",
"@teambit
Low
Suspicious Dependency Evidence
The manifest declares runtime dependencies including yargs and several Bit packages; the CLI parser loads yargs at runtime.
package.jsonView on unpkg · L11dist/cli-parser.jsView file
15function _yargs() {
const data = _interopRequireDefault(require("yargs"));
_yargs = function () {
return data;
Low
Suspicious Dependency Evidence
The manifest declares runtime dependencies including yargs and several Bit packages; the CLI parser loads yargs at runtime.
dist/cli-parser.jsView on unpkg · L15dist/pager.js
Findings
1 Medium6 Low
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Dependency Evidencepackage.json
LowSuspicious Dependency Evidencedist/cli-parser.js
LowAi Review Evidencedist/pager.js
Affected versions and remediation
This report applies to @teambit/cli@0.0.1430.
See all versions of @teambit/cli for other recorded verdicts.
- Review the evidence and your use of @teambit/cli@0.0.1430 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.