registry / @transcend-io/cli / 10.10.0

@transcend-io/cli@10.10.0

A command line interface for programmatic operations across Transcend.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a Transcend administration CLI with user-invoked API, CSV/YAML, policy, and worker commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs transcend or imports package APIs

Impact

Can modify Transcend tenant data or local output files when invoked with credentials and paths

Mechanism

package-aligned CLI operations using local files and Transcend APIs

Rationale

Static inspection shows risky primitives are tied to explicit CLI/admin workflows and package-aligned Transcend endpoints, with no lifecycle trigger or unconsented agent/control-surface mutation. The Unicode finding is explained by input normalization rather than hidden control-flow manipulation.

Evidence

package.jsondist/bin/cli.mjsdist/bin/deprecated-command.mjsdist/bin/bash-complete.mjsdist/uploadPrivacyRequestsFromCsv-i46OEhw-.mjsdist/constants-FP8lxFg5.mjsdist/impl-CWpfY0TU.mjsdist/runOpa-Cbh5ktOh.mjsdist/readCsv-C-5HBa7w.mjsdist/writeCsv-CbT4a0uj.mjs

Network endpoints3

api.transcend.ioconsent.transcend.ioapp.transcend.io

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

User-invoked CLI can read/write local CSV/YAML/receipt files and call Transcend APIs.
User-invoked commands include child_process for git/opa/worker flows, not lifecycle execution.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
bin entrypoints only run stricli CLI, bash completion, or deprecated-command help mapping.
Network defaults are package-aligned: https://api.transcend.io, https://consent.transcend.io, https://app.transcend.io.
Scanner Trojan Source hit is a regex stripping bidi chars from phone numbers in dist/uploadPrivacyRequestsFromCsv-i46OEhw-.mjs.
No Claude/Codex/Cursor/MCP/agent control-surface writes found.
No import-time exfiltration, persistence, or destructive behavior confirmed.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 114 file(s), 328 KB of source, external domains: api.transcend.io, api.us.transcend.io, app.transcend.io, consent.transcend.io, consent.us.transcend.io, docs.transcend.io, github.com, www.openpolicyagent.org

Source & flagged code

12 flagged

dist/uploadPrivacyRequestsFromCsv-i46OEhw-.mjsView file

Lines 1-2javascript

1import{a as e}from"./constants-FP8lxFg5.mjs";import{t}from"./logger-B-LXIf3U.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-KYaYveEQ.mjs";import{i as u,n as d,r as f,t as p}from"./parseAttributesFromString-tbxM3lmh.mjs";import{t as m}from"./readCsv-C-5HBa7w.mjs";import{r as h,t as g}from"./extractClientError-ZFI8f5OR.mjs";import{CompletedRequestStatus as _,IdentifierType as v,IsoCountryCode as y,IsoCountrySubdivisionCode as b,NORMALIZE_PHONE_NUMBER as x,RequestAction as S}from"@transcend-io/privacy-types";import{startCase as C,uniq as w}from"lodash-es";import{apply ...

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-i46OEhw-.mjsView on unpkg · L1

2//# sourceMappingURL=uploadPrivacyRequestsFromCsv-i46OEhw-.mjs.map

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-i46OEhw-.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-i46OEhw-.mjsView on unpkg

README.mdView file

Lines 1684-1724markdown

1684 --auth="$TRANSCEND_API_KEY" \

1685 --xdiLocation=https://cdn.your-site.com/xdi.js \

1686 --domainBlockList=ignored.com,localhost

1687```

1688

1689**Override XDI allowed commands**

1690

1691```sh

1692transcend consent build-xdi-sync-endpoint \

1693 --auth="$TRANSCEND_API_KEY" \

1694 --xdiLocation=https://cdn.your-site.com/xdi.js \

1695 --xdiAllowedCommands=ExtractIdentifiers:Simple

1696

Source & flagged code

12 flagged · loading source

dist/uploadPrivacyRequestsFromCsv-i46OEhw-.mjsView file

1contains invisible/control Unicode U+202D (left-to-right override) import{a as e}from"./constants-FP8lxFg5.mjs";import{t}from"./logger-B-LXIf3U.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-KYaYveEQ.mjs";import{i as u,n as d,r as f,t as p}from"./parseAttributesFromString-tbxM3l

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-i46OEhw-.mjsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-i46OEhw-.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-i46OEhw-.mjsView on unpkg

README.mdView file

1704patternName = generic_password severity = medium line = 1704 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L1704

2052patternName = generic_password severity = medium line = 2052 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2052

2628patternName = generic_password severity = medium line = 2628 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2628

2737patternName = generic_password severity = medium line = 2737 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2737

2752patternName = generic_password severity = medium line = 2752 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2752

3330patternName = generic_password severity = medium line = 3330 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3330

3341patternName = generic_password severity = medium line = 3341 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3341

3353patternName = generic_password severity = medium line = 3353 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3353

3365patternName = generic_password severity = medium line = 3365 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3365

3377patternName = generic_password severity = medium line = 3377 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3377

Findings

2 Critical12 Medium4 Low

CriticalTrojan Source Unicodedist/uploadPrivacyRequestsFromCsv-i46OEhw-.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/uploadPrivacyRequestsFromCsv-i46OEhw-.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

92%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorTranscend Inc.

Maintainerscami-transcend, michaelfarrell76, bencmbrook +6

Version10.17.0

PublishedJun 30, 2026

LicenseApache-2.0

Dependencies39

Integrityverified

Package size951 KB

Files240

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.mjstypes → ./dist/index.d.mtsexports mapbin → __tr-build-xdi-sync-endpoint, __tr-consent-manager-service-json-to-yml, __tr-consent-managers-to-business-entities +9

Runtimenode >=22.12.0

Artifact5.38 MB · 240 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, build:watch, check:exports, check:publint +7

Behavioral surface

ChildProcessEnvironmentVarsFilesystemHighEntropyStringsMinifiedUrlStringsManifest: clean

Lines 2717-2772markdown

2717

2718**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2719

2720```sh

2721transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

2722```

2723

2724**Use dynamic variables to fill out parameters in YAML files (see [./examples/multi-instance.yml](./examples/multi-instance.yml))**

2725

2726```sh

2727transcend inventory push --auth="$TRANSCEND_API_KEY" --variables=domain:acme.com,stage:staging

2728```

2729

2730**Push a single .yml file configuration into multiple Transcend instances**

2731

2732This uses the output of [`transcend admin generate-api-keys`](#transcend-admin-generate-api-keys).

2733

2734```sh

2735transcend admin generate-api-keys \

2736 --email=test@transcend.io \

2737 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2737

2738 --scopes="View Email Templates,View Data Map" \

2739 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2740 --file=./transcend-api-keys.json

2741transcend inventory pull --auth="$TRANSCEND_API_KEY"

2742transcend inventory push --auth=./transcend-api-keys.json

2743```

2744

2745**Push multiple .yml file configurations into multiple Transcend instances**

2746

2747This uses the output of [`transcend admin generate-api-keys`](#transcend-admin-generate-api-keys).

2748

2749```sh

2750transcend admin generate-api-keys \

2751 --email=test@transcend.io \

2752 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2752

2753 --scopes="View Email Templates,View Data Map" \

2754 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2755 --file=./transcend-api-keys.json

2756transcend inventory pull --auth=./transcend-api-keys.json --file=./transcend/

2757# <edit .yml files in folder in between these steps>

2758transcend inventory push --auth=./transcend-api-keys.json --file=./transcend/

2759```

2760

2761**Apply service classifier to all data flows**

2762

2763```sh

2764transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=dataFlows

2765transcend inventory push --auth="$TRANSCEND_API_KEY" --classifyService

2766```

2767

2768**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2769

2770```sh

2771transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=customFields

2772transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

Lines 3310-3361markdown

3310FLAGS

3311 --email The email address that you use to log into Transcend

3312 --password The password for your account login

3313 --apiKeyTitle The title of the API key being generated or destroyed

3314 --file The file where API keys should be written to

3316 [--deleteExistingApiKey/--noDeleteExistingApiKey] When true, if an API key exists with the specified apiKeyTitle, the existing API key is deleted [default = true]

3317 [--createNewApiKey/--noCreateNewApiKey] When true, new API keys will be created. Set to false if you simply want to delete all API keys with a title [default = true]

3318 [--parentOrganizationId] Filter for only a specific organization by ID, returning all child accounts associated with that organization

3319 [--transcendUrl] URL of the Transcend backend. Use https://api.us.transcend.io for US hosting [default = https://api.transcend.io]

3320 -h --help Print help information and exit

3321```

3322

3323#### Examples

3324

3325**Generate API keys for cross-instance usage**

3326

3327```sh

3328transcend admin generate-api-keys \

3329 --email=test@transcend.io \

3330 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3330

3331 --scopes="View Email Templates,View Data Map" \

3332 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3333 --file=./working/auth.json

3334```

3335

3336**Specifying the backend URL, needed for US hosted backend infrastructure**

3337

3338```sh

3339transcend admin generate-api-keys \

3340 --email=test@transcend.io \

3341 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3341

3342 --scopes="View Email Templates,View Data Map" \

3343 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3344 --file=./working/auth.json \

3345 --transcendUrl=https://api.us.transcend.io

3346```

3347

3348**Filter for only a specific organization by ID, returning all child accounts associated with that organization**

3349

3350```sh

3351transcend admin generate-api-keys \

3352 --email=test@transcend.io \

3353 --password="$TRANSCEND_PASSWORD" \

3354 --scopes="View Email Templates,View Data Map" \

3355 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3356 --file=./working/auth.json \

3357 --parentOrganizationId=7098bb38-070d-4f26-8fa4-1b61b9cdef77

3358```

3359

3360**Delete all API keys with a certain title**

3361

Long lines were clipped for display.