registry / @transcend-io/cli / 10.12.0

@transcend-io/cli@10.12.0

A command line interface for programmatic operations across Transcend.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a broad Transcend administration CLI with explicit commands for syncing privacy data, scanning dependency files, and writing requested output files.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit invocation of the transcend CLI or legacy bin aliases

Impact

Can modify Transcend/OneTrust resources or local output files only when run with user-supplied arguments and credentials

Mechanism

User-invoked product administration commands

Rationale

Static source inspection shows no install-time execution, persistence, exfiltration, or unconsented agent control-surface mutation. Risky primitives are documented, user-invoked CLI administration features aligned with the package purpose.

Evidence

package.jsondist/bin/cli.mjsdist/bin/deprecated-command.mjsdist/constants-rqnINlU5.mjsdist/uploadPrivacyRequestsFromCsv-LXCzTs5N.mjsdist/impl-BL4tVycI.mjsdist/runOpa-DI_fUjsb.mjs

Network endpoints4

app.transcend.ioapi.transcend.ioconsent.transcend.io{user-supplied OneTrust hostname}

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

User-invoked CLI can read/write caller-specified CSV/YAML/JSON outputs and receipts
User-invoked commands can run local tools such as git, opa, and duckdb for documented scanning/policy workflows

Evidence against

package.json has no preinstall/install/postinstall/prepare lifecycle hooks
bin entrypoints only invoke @stricli CLI or deprecated-command help mapping
dist/constants-rqnINlU5.mjs endpoints are Transcend product URLs with env overrides
dist/uploadPrivacyRequestsFromCsv-LXCzTs5N.mjs bidi chars occur in a regex stripping phone-number controls, not hidden control flow
No writes to AI-agent control surfaces such as .mcp.json, CLAUDE.md, Cursor, Claude, or Codex settings found
Network and credential use is tied to explicit Transcend/OneTrust CLI commands requiring user-supplied auth

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 120 file(s), 332 KB of source, external domains: api.transcend.io, api.us.transcend.io, app.transcend.io, consent.transcend.io, consent.us.transcend.io, docs.transcend.io, github.com, www.openpolicyagent.org

Source & flagged code

12 flagged

dist/uploadPrivacyRequestsFromCsv-LXCzTs5N.mjsView file

Lines 1-2javascript

1import{a as e}from"./constants-rqnINlU5.mjs";import{t}from"./logger-B-LXIf3U.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-KYaYveEQ.mjs";import{i as u,n as d,r as f,t as p}from"./parseAttributesFromString-tbxM3lmh.mjs";import{t as m}from"./readCsv-C-5HBa7w.mjs";import{r as h,t as g}from"./extractClientError-ZFI8f5OR.mjs";import{CompletedRequestStatus as _,IdentifierType as v,IsoCountryCode as y,IsoCountrySubdivisionCode as b,NORMALIZE_PHONE_NUMBER as x,RequestAction as S}from"@transcend-io/privacy-types";import{startCase as C,uniq as w}from"lodash-es";import{apply ...

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-LXCzTs5N.mjsView on unpkg · L1

2//# sourceMappingURL=uploadPrivacyRequestsFromCsv-LXCzTs5N.mjs.map

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-LXCzTs5N.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-LXCzTs5N.mjsView on unpkg

README.mdView file

Lines 1686-1726markdown

1686 --auth="$TRANSCEND_API_KEY" \

1687 --xdiLocation=https://cdn.your-site.com/xdi.js \

1688 --domainBlockList=ignored.com,localhost

1689```

1690

1691**Override XDI allowed commands**

1692

1693```sh

1694transcend consent build-xdi-sync-endpoint \

1695 --auth="$TRANSCEND_API_KEY" \

1696 --xdiLocation=https://cdn.your-site.com/xdi.js \

1697 --xdiAllowedCommands=ExtractIdentifiers:Simple

1698

Source & flagged code

12 flagged · loading source

dist/uploadPrivacyRequestsFromCsv-LXCzTs5N.mjsView file

1contains invisible/control Unicode U+202D (left-to-right override) import{a as e}from"./constants-rqnINlU5.mjs";import{t}from"./logger-B-LXIf3U.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-KYaYveEQ.mjs";import{i as u,n as d,r as f,t as p}from"./parseAttributesFromString-tbxM3l

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-LXCzTs5N.mjsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-LXCzTs5N.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-LXCzTs5N.mjsView on unpkg

README.mdView file

1706patternName = generic_password severity = medium line = 1706 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L1706

2054patternName = generic_password severity = medium line = 2054 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2054

2630patternName = generic_password severity = medium line = 2630 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2630

2739patternName = generic_password severity = medium line = 2739 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2739

2754patternName = generic_password severity = medium line = 2754 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2754

3332patternName = generic_password severity = medium line = 3332 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3332

3343patternName = generic_password severity = medium line = 3343 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3343

3355patternName = generic_password severity = medium line = 3355 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3355

3367patternName = generic_password severity = medium line = 3367 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3367

3379patternName = generic_password severity = medium line = 3379 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3379

Findings

2 Critical12 Medium4 Low

CriticalTrojan Source Unicodedist/uploadPrivacyRequestsFromCsv-LXCzTs5N.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/uploadPrivacyRequestsFromCsv-LXCzTs5N.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

92%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorTranscend Inc.

Maintainerscami-transcend, michaelfarrell76, bencmbrook +6

Version10.17.0

PublishedJul 1, 2026

LicenseApache-2.0

Dependencies39

Integrityverified

Package size957 KB

Files252

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.mjstypes → ./dist/index.d.mtsexports mapbin → __tr-build-xdi-sync-endpoint, __tr-consent-manager-service-json-to-yml, __tr-consent-managers-to-business-entities +9

Runtimenode >=22.12.0

Artifact5.40 MB · 252 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, build:watch, check:exports, check:publint +7

Behavioral surface

ChildProcessEnvironmentVarsFilesystemHighEntropyStringsMinifiedUrlStringsManifest: clean

Lines 2719-2774markdown

2719

2720**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2721

2722```sh

2723transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

2724```

2725

2726**Use dynamic variables to fill out parameters in YAML files (see [./examples/multi-instance.yml](./examples/multi-instance.yml))**

2727

2728```sh

2729transcend inventory push --auth="$TRANSCEND_API_KEY" --variables=domain:acme.com,stage:staging

2730```

2731

2732**Push a single .yml file configuration into multiple Transcend instances**

2733

2734This uses the output of [`transcend admin generate-api-keys`](#transcend-admin-generate-api-keys).

2735

2736```sh

2737transcend admin generate-api-keys \

2738 --email=test@transcend.io \

2739 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2739

2740 --scopes="View Email Templates,View Data Map" \

2741 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2742 --file=./transcend-api-keys.json

2743transcend inventory pull --auth="$TRANSCEND_API_KEY"

2744transcend inventory push --auth=./transcend-api-keys.json

2745```

2746

2747**Push multiple .yml file configurations into multiple Transcend instances**

2748

2749This uses the output of [`transcend admin generate-api-keys`](#transcend-admin-generate-api-keys).

2750

2751```sh

2752transcend admin generate-api-keys \

2753 --email=test@transcend.io \

2754 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2754

2755 --scopes="View Email Templates,View Data Map" \

2756 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2757 --file=./transcend-api-keys.json

2758transcend inventory pull --auth=./transcend-api-keys.json --file=./transcend/

2759# <edit .yml files in folder in between these steps>

2760transcend inventory push --auth=./transcend-api-keys.json --file=./transcend/

2761```

2762

2763**Apply service classifier to all data flows**

2764

2765```sh

2766transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=dataFlows

2767transcend inventory push --auth="$TRANSCEND_API_KEY" --classifyService

2768```

2769

2770**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2771

2772```sh

2773transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=customFields

2774transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

Lines 3312-3363markdown

3312FLAGS

3313 --email The email address that you use to log into Transcend

3314 --password The password for your account login

3315 --apiKeyTitle The title of the API key being generated or destroyed

3316 --file The file where API keys should be written to

3318 [--deleteExistingApiKey/--noDeleteExistingApiKey] When true, if an API key exists with the specified apiKeyTitle, the existing API key is deleted [default = true]

3319 [--createNewApiKey/--noCreateNewApiKey] When true, new API keys will be created. Set to false if you simply want to delete all API keys with a title [default = true]

3320 [--parentOrganizationId] Filter for only a specific organization by ID, returning all child accounts associated with that organization

3321 [--transcendUrl] URL of the Transcend backend. Use https://api.us.transcend.io for US hosting [default = https://api.transcend.io]

3322 -h --help Print help information and exit

3323```

3324

3325#### Examples

3326

3327**Generate API keys for cross-instance usage**

3328

3329```sh

3330transcend admin generate-api-keys \

3331 --email=test@transcend.io \

3332 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3332

3333 --scopes="View Email Templates,View Data Map" \

3334 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3335 --file=./working/auth.json

3336```

3337

3338**Specifying the backend URL, needed for US hosted backend infrastructure**

3339

3340```sh

3341transcend admin generate-api-keys \

3342 --email=test@transcend.io \

3343 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3343

3344 --scopes="View Email Templates,View Data Map" \

3345 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3346 --file=./working/auth.json \

3347 --transcendUrl=https://api.us.transcend.io

3348```

3349

3350**Filter for only a specific organization by ID, returning all child accounts associated with that organization**

3351

3352```sh

3353transcend admin generate-api-keys \

3354 --email=test@transcend.io \

3355 --password="$TRANSCEND_PASSWORD" \

3356 --scopes="View Email Templates,View Data Map" \

3357 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3358 --file=./working/auth.json \

3359 --parentOrganizationId=7098bb38-070d-4f26-8fa4-1b61b9cdef77

3360```

3361

3362**Delete all API keys with a certain title**

3363

Long lines were clipped for display.