registry / @thinkdata/cli / 0.2.1

@thinkdata/cli@0.2.1

ThinkERD CLI — Database schema extraction and comparison tool

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `thinkdata serve`.

Impact

A malicious webpage could use the running agent to probe reachable databases or extract schemas when usable credentials/default trust are available.

Mechanism

Unauthenticated cross-origin localhost DB proxy/schema extractor.

Rationale

The package is not malicious by source evidence, but its opt-in local agent exposes powerful database operations to arbitrary origins without authentication. Flag as a warning for this concrete capability vulnerability.

Evidence

package.jsondist/bin/thinkdata.jsdist/commands/serve.jsdist/commands/extract.jsdist/commands/auth.jsdist/extractors/index.js

Network endpoints2

127.0.0.1:3100api.thinkdata.dev/api/cli/import-schema

Decision evidence

public snapshot

@thinkdata/cli@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code