registry / @transcend-io/cli / 10.17.0

@transcend-io/cli@10.17.0

⚠ Under review

A command line interface for programmatic operations across Transcend.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 124 file(s), 341 KB of source, external domains: api.transcend.io, api.us.transcend.io, app.transcend.io, consent.transcend.io, consent.us.transcend.io, docs.transcend.io, github.com, www.openpolicyagent.org

Source & flagged code

13 flagged

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView file

Lines 1-2javascript

1import{a as e}from"./constants-BeMH_MWn.mjs";import{t}from"./logger-D1tXVwJj.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-BSZc6Ifl.mjs";import{n as u,t as d}from"./fuzzyMatchColumns-jgLi9Qnf.mjs";import{n as f,t as p}from"./parseAttributesFromString-COM7aBEj.mjs";import{t as m}from"./readCsv-ddmavI86.mjs";import{r as h,t as g}from"./extractClientError-_9Bqmm0v.mjs";import{CompletedRequestStatus as _,IdentifierType as v,IsoCountryCode as y,IsoCountrySubdivisionCode as b,NORMALIZE_PHONE_NUMBER as x,RequestAction as S}from"@transcend-io/privacy-types";import{startCas ...

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView on unpkg · L1

2//# sourceMappingURL=uploadPrivacyRequestsFromCsv-DFKHnc0H.mjs.map

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-DFKHnc0H.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView on unpkg

dist/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @transcend-io/cli@10.12.2 matchedIdentity = npm:QHRyYW5zY2VuZC1pby9jbGk:10.12.2 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

README.mdView file

Lines 1700-1740markdown

1700 --auth="$TRANSCEND_API_KEY" \

1701 --xdiLocation=https://cdn.your-site.com/xdi.js \

1702 --domainBlockList=ignored.com,localhost

1703```

1704

1705**Override XDI allowed commands**

1706

1707```sh

1708transcend consent build-xdi-sync-endpoint \

1709 --auth="$TRANSCEND_API_KEY" \

1710 --xdiLocation=https://cdn.your-site.com/xdi.js \

1711 --xdiAllowedCommands=ExtractIdentifiers:Simple

1712

Source & flagged code

13 flagged · loading source

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView file

1contains invisible/control Unicode U+202D (left-to-right override) import{a as e}from"./constants-BeMH_MWn.mjs";import{t}from"./logger-D1tXVwJj.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-BSZc6Ifl.mjs";import{n as u,t as d}from"./fuzzyMatchColumns-jgLi9Qnf.mjs";import{n as f,

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-DFKHnc0H.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView on unpkg

dist/index.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

README.mdView file

1720patternName = generic_password severity = medium line = 1720 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L1720

2068patternName = generic_password severity = medium line = 2068 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2068

2645patternName = generic_password severity = medium line = 2645 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2645

2755patternName = generic_password severity = medium line = 2755 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2755

2770patternName = generic_password severity = medium line = 2770 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2770

3357patternName = generic_password severity = medium line = 3357 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3357

3368patternName = generic_password severity = medium line = 3368 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3368

3380patternName = generic_password severity = medium line = 3380 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3380

3392patternName = generic_password severity = medium line = 3392 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3392

3404patternName = generic_password severity = medium line = 3404 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3404

Findings

3 Critical12 Medium4 Low

CriticalTrojan Source Unicodedist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjs

CriticalPrevious Version Dangerous Deltadist/index.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView file

Lines 1-2javascript

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView on unpkg · L1

2//# sourceMappingURL=uploadPrivacyRequestsFromCsv-DFKHnc0H.mjs.map

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-DFKHnc0H.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView on unpkg

dist/index.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

README.mdView file

Lines 1700-1740markdown

1700 --auth="$TRANSCEND_API_KEY" \

1701 --xdiLocation=https://cdn.your-site.com/xdi.js \

1702 --domainBlockList=ignored.com,localhost

1703```

1704

1705**Override XDI allowed commands**

1706

1707```sh

1708transcend consent build-xdi-sync-endpoint \

1709 --auth="$TRANSCEND_API_KEY" \

1710 --xdiLocation=https://cdn.your-site.com/xdi.js \

1711 --xdiAllowedCommands=ExtractIdentifiers:Simple

1712

Lines 2625-2665markdown

2625transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=privacyCenters,messages

2626```

2627

2628**Pull assessments and assessment templates**

2629

2630```sh

2631transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=assessments,assessmentTemplates

2632```

2633

2634**Pull everything**

2635

2636```sh

2637transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=all

2638```

2639

2640**Pull configuration files across multiple instances**

2641

2642```sh

2643transcend admin generate-api-keys \

2644 --email=test@transcend.io \

2645 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2645

2646 --scopes="View Consent Manager" \

2647 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2648 --file=./transcend-api-keys.json

2649transcend inventory pull --auth=./transcend-api-keys.json --resources=consentManager --file=./transcend/

2650```

2651

2652Note: This command will overwrite the existing transcend.yml file that you have locally.

2653

2654### `transcend inventory push`

2655

2656```txt

2657USAGE

2658 transcend inventory push (--auth value) [--file value] [--transcendUrl value] [--pageSize value] [--variables value] [--publishToPrivacyCenter] [--classifyService] [--deleteExtraAttributeValues]

2659 transcend inventory push --help

2660

2661Given a transcend.yml file, sync the contents up to your Transcend instance.

2662

2663FLAGS

2664 --auth The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. The scopes required will vary depending on the operation performed. If in doubt, the Full Admin scope will always work.

2665 [--file] Path to the YAML file to push from [default = ./transcend.yml]

Lines 2735-2790markdown

2735

2736**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2737

2738```sh

2739transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

2740```

2741

2742**Use dynamic variables to fill out parameters in YAML files (see [./examples/multi-instance.yml](./examples/multi-instance.yml))**

2743

2744```sh

2745transcend inventory push --auth="$TRANSCEND_API_KEY" --variables=domain:acme.com,stage:staging

2746```

2747

2748**Push a single .yml file configuration into multiple Transcend instances**

2749

2750This uses the output of [`transcend admin generate-api-keys`](#transcend-admin-generate-api-keys).

2751

2752```sh

2753transcend admin generate-api-keys \

2754 --email=test@transcend.io \

2755 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2755

2756 --scopes="View Email Templates,View Data Map" \

2757 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2758 --file=./transcend-api-keys.json

2759transcend inventory pull --auth="$TRANSCEND_API_KEY"

2760transcend inventory push --auth=./transcend-api-keys.json

2761```

2762

2763**Push multiple .yml file configurations into multiple Transcend instances**

2764

2765This uses the output of [`transcend admin generate-api-keys`](#transcend-admin-generate-api-keys).

2766

2767```sh

2768transcend admin generate-api-keys \

2769 --email=test@transcend.io \

2770 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2770

2771 --scopes="View Email Templates,View Data Map" \

2772 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2773 --file=./transcend-api-keys.json

2774transcend inventory pull --auth=./transcend-api-keys.json --file=./transcend/

2775# <edit .yml files in folder in between these steps>

2776transcend inventory push --auth=./transcend-api-keys.json --file=./transcend/

2777```

2778

2779**Apply service classifier to all data flows**

2780

2781```sh

2782transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=dataFlows

2783transcend inventory push --auth="$TRANSCEND_API_KEY" --classifyService

2784```

2785

2786**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2787

2788```sh

2789transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=customFields

2790transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

Lines 3337-3388markdown

3337FLAGS

3338 --email The email address that you use to log into Transcend

3339 --password The password for your account login

3340 --apiKeyTitle The title of the API key being generated or destroyed

3341 --file The file where API keys should be written to

3343 [--deleteExistingApiKey/--noDeleteExistingApiKey] When true, if an API key exists with the specified apiKeyTitle, the existing API key is deleted [default = true]

3344 [--createNewApiKey/--noCreateNewApiKey] When true, new API keys will be created. Set to false if you simply want to delete all API keys with a title [default = true]

3345 [--parentOrganizationId] Filter for only a specific organization by ID, returning all child accounts associated with that organization

3346 [--transcendUrl] URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcendUrl may be omitted if it is exported. [default = https://api.transcend.io]

3347 -h --help Print help information and exit

3348```

3349

3350#### Examples

3351

3352**Generate API keys for cross-instance usage**

3353

3354```sh

3355transcend admin generate-api-keys \

3356 --email=test@transcend.io \

3357 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3357

3358 --scopes="View Email Templates,View Data Map" \

3359 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3360 --file=./working/auth.json

3361```

3362

3363**Specifying the backend URL, needed for US hosted backend infrastructure**

3364

3365```sh

3366transcend admin generate-api-keys \

3367 --email=test@transcend.io \

3368 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3368

3369 --scopes="View Email Templates,View Data Map" \

3370 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3371 --file=./working/auth.json \

3372 --transcendUrl=https://api.us.transcend.io

3373```

3374

3375**Filter for only a specific organization by ID, returning all child accounts associated with that organization**

3376

3377```sh

3378transcend admin generate-api-keys \

3379 --email=test@transcend.io \

3380 --password="$TRANSCEND_PASSWORD" \

3381 --scopes="View Email Templates,View Data Map" \

3382 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3383 --file=./working/auth.json \

3384 --parentOrganizationId=7098bb38-070d-4f26-8fa4-1b61b9cdef77

3385```

3386

3387**Delete all API keys with a certain title**

3388

Long lines were clipped for display.