registry / @texonom/cli / 1.6.8
@texonom/cli@1.6.8
Texonom CLI which has ability to export data from Notion.so
AI Security Review
scanned 14d ago · by lpm-firewall-aiInspected source shows Notion authentication directed to the intended Notion API and remote repository pushes gated by the user’s --push option. The manifest has no install hook, and the inspected prepared dependency sources show no attack behavior.
Static reason
No blocking static signals were detected.
Trigger
A user runs the Notion export CLI; remote pushes additionally require --push.
Impact
No confirmed unauthorized credential transfer or other attack surface was established.
Mechanism
The CLI sends the supplied Notion token to the Notion API and can force-push exported files to fixed Texonom repositories when --push is enabled.
AI rationale
Inspected source shows Notion authentication directed to the intended Notion API and remote repository pushes gated by the user’s --push option. The manifest has no install hook, and the inspected prepared dependency sources show no attack behavior.
Network endpoints3
www.notion.so/api/v3github.com/texonom/texonom-raw.gitgithub.com/texonom/texonom-md.git
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a CLI entrypoint and has no install lifecycle hook; its scripts are build and release tasks.
- The CLI uses Notion credentials with the Notion API endpoint, and sends them to that endpoint.
- Git pushes target fixed Texonom repositories and run only when the user enables --push.
- The prepared @texonom/nclient and @texonom/ntypes snapshots have ordinary library entrypoints and no install hooks.
- The prepared @texonom/nutils snapshot exposes data utility code; inspected excerpts show no attack behavior.
Evidence against
Behavioral surface
ChildProcessFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedbuild/src/main.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
build/src/main.js#virtual:normalized:round1View on unpkgpackage.jsonView file
23"bin": {
"notion": "./build/src/main.js"
},
"dependencies": {
"@texonom/nclient": "^1.6.8",
"@texonom/ntypes": "^1.6.8",
"@texonom/nutils": "^1.6.8",
"JSONStream": "^1.3.5",
"clipanion": "^3
Low
Suspicious Lifecycle Evidence
package.json exposes a CLI entrypoint and has no install lifecycle hook; its scripts are build and release tasks.
package.jsonView on unpkg · L2345"scripts": {
"build": "tsc && vite build",
"watch": "vite build --watch --mode development",
"test": "vitest --run",
"prerelease": "standard-version --sk[redacted] --prerelease",
"release": "stand
Findings
1 High11 Low
HighSemantic Analysis Limitedbuild/src/main.js#virtual:normalized:round1
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-8888578f-f022-470d-842f-607394a46faf/0/npm-linux/package.json
LowSuspicious Lifecycle Evidence.lpm-dependency-evidence-8888578f-f022-470d-842f-607394a46faf/1/npm-linux/package.json
LowAi Review Evidence.lpm-dependency-evidence-8888578f-f022-470d-842f-607394a46faf/0/npm-linux/build/index.js
LowAi Review Evidence.lpm-dependency-evidence-8888578f-f022-470d-842f-607394a46faf/0/npm-linux/build/index.js
Affected versions and remediation
This report applies to @texonom/cli@1.6.8.
See all versions of @texonom/cli for other recorded verdicts.
- Review the evidence and your use of @texonom/cli@1.6.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.