registry / @transcend-io/cli / 10.12.1

@transcend-io/cli@10.12.1

A command line interface for programmatic operations across Transcend.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a broad Transcend operations CLI with user-invoked API, CSV/YAML, policy, and file-processing commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the transcend CLI or legacy bin aliases

Impact

Can read/write user-specified files and call Transcend APIs when invoked with credentials, but no install-time or import-time abuse was found

Mechanism

authenticated Transcend CLI operations and local import/export helpers

Rationale

Static inspection shows no lifecycle hook, no foreign AI-agent control-surface mutation, and no credential/file exfiltration outside package-aligned Transcend CLI behavior. Scanner findings map to legitimate user-invoked CLI functionality, including API calls, local file import/export, and a bidi-character regex used for phone cleanup.

Evidence

package.jsondist/bin/cli.mjsdist/bin/deprecated-command.mjsdist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjsdist/constants-W0InNUWp.mjsdist/runOpa-BLjrKfy_.mjsdist/context-CdSyuBlf.mjs

Network endpoints4

api.transcend.ioapi.us.transcend.ioconsent.transcend.ioapp.transcend.io

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts
dist/bin/cli.mjs only invokes @stricli/core run with process argv
dist/bin/deprecated-command.mjs only prints deprecation/help text and exits
dist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjs bidi characters occur in a phone-normalization regex, not hidden control flow
Network use is Transcend API/Sombra/consent service aligned and gated by CLI auth flags
child_process usage is limited to user-invoked OPA/git/duckdb helper commands

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 121 file(s), 333 KB of source, external domains: api.transcend.io, api.us.transcend.io, app.transcend.io, consent.transcend.io, consent.us.transcend.io, docs.transcend.io, github.com, www.openpolicyagent.org

Source & flagged code

12 flagged

dist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjsView file

Lines 1-2javascript

1import{a as e}from"./constants-W0InNUWp.mjs";import{t}from"./logger-B-LXIf3U.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-KYaYveEQ.mjs";import{n as u,t as d}from"./fuzzyMatchColumns-Dym9eeQe.mjs";import{n as f,t as p}from"./parseAttributesFromString-ByzY22WY.mjs";import{t as m}from"./readCsv-D1e7WRTc.mjs";import{r as h,t as g}from"./extractClientError-CaF_Kj-f.mjs";import{CompletedRequestStatus as _,IdentifierType as v,IsoCountryCode as y,IsoCountrySubdivisionCode as b,NORMALIZE_PHONE_NUMBER as x,RequestAction as S}from"@transcend-io/privacy-types";import{startCas ...

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjsView on unpkg · L1

2//# sourceMappingURL=uploadPrivacyRequestsFromCsv-dgtJzNwi.mjs.map

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-dgtJzNwi.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjsView on unpkg

README.mdView file

Lines 1686-1726markdown

1686 --auth="$TRANSCEND_API_KEY" \

1687 --xdiLocation=https://cdn.your-site.com/xdi.js \

1688 --domainBlockList=ignored.com,localhost

1689```

1690

1691**Override XDI allowed commands**

1692

1693```sh

1694transcend consent build-xdi-sync-endpoint \

1695 --auth="$TRANSCEND_API_KEY" \

1696 --xdiLocation=https://cdn.your-site.com/xdi.js \

1697 --xdiAllowedCommands=ExtractIdentifiers:Simple

1698

Source & flagged code

12 flagged · loading source

dist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjsView file

1contains invisible/control Unicode U+202D (left-to-right override) import{a as e}from"./constants-W0InNUWp.mjs";import{t}from"./logger-B-LXIf3U.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-KYaYveEQ.mjs";import{n as u,t as d}from"./fuzzyMatchColumns-Dym9eeQe.mjs";import{n as f,

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-dgtJzNwi.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjsView on unpkg

README.mdView file

1706patternName = generic_password severity = medium line = 1706 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L1706

2054patternName = generic_password severity = medium line = 2054 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2054

2630patternName = generic_password severity = medium line = 2630 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2630

2739patternName = generic_password severity = medium line = 2739 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2739

2754patternName = generic_password severity = medium line = 2754 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2754

3332patternName = generic_password severity = medium line = 3332 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3332

3343patternName = generic_password severity = medium line = 3343 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3343

3355patternName = generic_password severity = medium line = 3355 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3355

3367patternName = generic_password severity = medium line = 3367 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3367

3379patternName = generic_password severity = medium line = 3379 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3379

Findings

2 Critical12 Medium4 Low

CriticalTrojan Source Unicodedist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

93%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorTranscend Inc.

Maintainerscami-transcend, michaelfarrell76, bencmbrook +6

Version10.17.0

PublishedJul 1, 2026

LicenseApache-2.0

Dependencies39

Integrityverified

Package size958 KB

Files254

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.mjstypes → ./dist/index.d.mtsexports mapbin → __tr-build-xdi-sync-endpoint, __tr-consent-manager-service-json-to-yml, __tr-consent-managers-to-business-entities +9

Runtimenode >=22.12.0

Artifact5.40 MB · 254 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, build:watch, check:exports, check:publint +7

Behavioral surface

ChildProcessEnvironmentVarsFilesystemHighEntropyStringsMinifiedUrlStringsManifest: clean

Source & flagged code

12 flagged

dist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjsView file

Lines 1-2javascript

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjsView on unpkg · L1

2//# sourceMappingURL=uploadPrivacyRequestsFromCsv-dgtJzNwi.mjs.map

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-dgtJzNwi.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-dgtJzNwi.mjsView on unpkg

README.mdView file

Lines 1686-1726markdown

1686 --auth="$TRANSCEND_API_KEY" \

1687 --xdiLocation=https://cdn.your-site.com/xdi.js \

1688 --domainBlockList=ignored.com,localhost

1689```

1690

1691**Override XDI allowed commands**

1692

1693```sh

1694transcend consent build-xdi-sync-endpoint \

1695 --auth="$TRANSCEND_API_KEY" \

1696 --xdiLocation=https://cdn.your-site.com/xdi.js \

1697 --xdiAllowedCommands=ExtractIdentifiers:Simple

1698

Lines 2719-2774markdown

2719

2720**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2721

2722```sh

2723transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

2724```

2725

2726**Use dynamic variables to fill out parameters in YAML files (see [./examples/multi-instance.yml](./examples/multi-instance.yml))**

2727

2728```sh

2729transcend inventory push --auth="$TRANSCEND_API_KEY" --variables=domain:acme.com,stage:staging

2730```

2731

2732**Push a single .yml file configuration into multiple Transcend instances**

2733

2734This uses the output of [`transcend admin generate-api-keys`](#transcend-admin-generate-api-keys).

2735

2736```sh

2737transcend admin generate-api-keys \

2738 --email=test@transcend.io \

2739 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2739

2740 --scopes="View Email Templates,View Data Map" \

2741 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2742 --file=./transcend-api-keys.json

2743transcend inventory pull --auth="$TRANSCEND_API_KEY"

2744transcend inventory push --auth=./transcend-api-keys.json

2745```

2746

2747**Push multiple .yml file configurations into multiple Transcend instances**

2748

2749This uses the output of [`transcend admin generate-api-keys`](#transcend-admin-generate-api-keys).

2750

2751```sh

2752transcend admin generate-api-keys \

2753 --email=test@transcend.io \

2754 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2754

2755 --scopes="View Email Templates,View Data Map" \

2756 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2757 --file=./transcend-api-keys.json

2758transcend inventory pull --auth=./transcend-api-keys.json --file=./transcend/

2759# <edit .yml files in folder in between these steps>

2760transcend inventory push --auth=./transcend-api-keys.json --file=./transcend/

2761```

2762

2763**Apply service classifier to all data flows**

2764

2765```sh

2766transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=dataFlows

2767transcend inventory push --auth="$TRANSCEND_API_KEY" --classifyService

2768```

2769

2770**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2771

2772```sh

2773transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=customFields

2774transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

Lines 3312-3363markdown

3312FLAGS

3313 --email The email address that you use to log into Transcend

3314 --password The password for your account login

3315 --apiKeyTitle The title of the API key being generated or destroyed

3316 --file The file where API keys should be written to

3318 [--deleteExistingApiKey/--noDeleteExistingApiKey] When true, if an API key exists with the specified apiKeyTitle, the existing API key is deleted [default = true]

3319 [--createNewApiKey/--noCreateNewApiKey] When true, new API keys will be created. Set to false if you simply want to delete all API keys with a title [default = true]

3320 [--parentOrganizationId] Filter for only a specific organization by ID, returning all child accounts associated with that organization

3321 [--transcendUrl] URL of the Transcend backend. Use https://api.us.transcend.io for US hosting [default = https://api.transcend.io]

3322 -h --help Print help information and exit

3323```

3324

3325#### Examples

3326

3327**Generate API keys for cross-instance usage**

3328

3329```sh

3330transcend admin generate-api-keys \

3331 --email=test@transcend.io \

3332 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3332

3333 --scopes="View Email Templates,View Data Map" \

3334 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3335 --file=./working/auth.json

3336```

3337

3338**Specifying the backend URL, needed for US hosted backend infrastructure**

3339

3340```sh

3341transcend admin generate-api-keys \

3342 --email=test@transcend.io \

3343 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3343

3344 --scopes="View Email Templates,View Data Map" \

3345 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3346 --file=./working/auth.json \

3347 --transcendUrl=https://api.us.transcend.io

3348```

3349

3350**Filter for only a specific organization by ID, returning all child accounts associated with that organization**

3351

3352```sh

3353transcend admin generate-api-keys \

3354 --email=test@transcend.io \

3355 --password="$TRANSCEND_PASSWORD" \

3356 --scopes="View Email Templates,View Data Map" \

3357 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3358 --file=./working/auth.json \

3359 --parentOrganizationId=7098bb38-070d-4f26-8fa4-1b61b9cdef77

3360```

3361

3362**Delete all API keys with a certain title**

3363

Long lines were clipped for display.