registry / @transcend-io/cli / 10.12.2

@transcend-io/cli@10.12.2

A command line interface for programmatic operations across Transcend.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked Transcend administration CLI with expected API, filesystem, and local tool operations for importing/exporting privacy, consent, inventory, and policy data.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit invocation of the transcend CLI or legacy bin aliases

Impact

Expected read/write/API effects scoped to selected CLI commands and user-provided files

Mechanism

User-directed admin CLI operations

Rationale

Static inspection found no install-time/import-time execution, credential harvesting, exfiltration, persistence, or AI-agent control-surface mutation. Risky primitives are tied to documented, user-invoked administrative workflows for the Transcend CLI.

Evidence

package.jsondist/bin/cli.mjsdist/bin/deprecated-command.mjsdist/bin/bash-complete.mjsdist/app-Q6Dd5KY8.mjsdist/constants-B6wEjJhL.mjsdist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjsdist/impl-BoIgxdNp.mjsdist/impl-CmPkzyZT.mjs

Network endpoints3

api.transcend.ioconsent.transcend.ioapp.transcend.io

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

User-invoked commands can read/write CSV/YAML/receipts and call Transcend APIs
dist/impl-BoIgxdNp.mjs uses execSync for git config in scan-packages
dist/impl-CmPkzyZT.mjs runs opa/tar/git for policy publishing

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks
dist/bin/cli.mjs only dispatches CLI args through @stricli/core
dist/bin/deprecated-command.mjs only prints deprecation help and exits
Trojan-source hint not confirmed: bidi/invisible scan of uploadPrivacyRequestsFromCsv files returned no hits
Network defaults are package-aligned Transcend endpoints in dist/constants-B6wEjJhL.mjs
No Claude/Codex/Cursor/MCP control-surface writes found

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 121 file(s), 334 KB of source, external domains: api.transcend.io, api.us.transcend.io, app.transcend.io, consent.transcend.io, consent.us.transcend.io, docs.transcend.io, github.com, www.openpolicyagent.org

Source & flagged code

12 flagged

dist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjsView file

Lines 1-2javascript

1import{a as e}from"./constants-B6wEjJhL.mjs";import{t}from"./logger-B-LXIf3U.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-KYaYveEQ.mjs";import{n as u,t as d}from"./fuzzyMatchColumns-Dym9eeQe.mjs";import{n as f,t as p}from"./parseAttributesFromString-ByzY22WY.mjs";import{t as m}from"./readCsv-D1e7WRTc.mjs";import{r as h,t as g}from"./extractClientError-CaF_Kj-f.mjs";import{CompletedRequestStatus as _,IdentifierType as v,IsoCountryCode as y,IsoCountrySubdivisionCode as b,NORMALIZE_PHONE_NUMBER as x,RequestAction as S}from"@transcend-io/privacy-types";import{startCas ...

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjsView on unpkg · L1

2//# sourceMappingURL=uploadPrivacyRequestsFromCsv-DtdcpxcS.mjs.map

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-DtdcpxcS.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjsView on unpkg

README.mdView file

Lines 1686-1726markdown

1686 --auth="$TRANSCEND_API_KEY" \

1687 --xdiLocation=https://cdn.your-site.com/xdi.js \

1688 --domainBlockList=ignored.com,localhost

1689```

1690

1691**Override XDI allowed commands**

1692

1693```sh

1694transcend consent build-xdi-sync-endpoint \

1695 --auth="$TRANSCEND_API_KEY" \

1696 --xdiLocation=https://cdn.your-site.com/xdi.js \

1697 --xdiAllowedCommands=ExtractIdentifiers:Simple

1698

Source & flagged code

12 flagged · loading source

dist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjsView file

1contains invisible/control Unicode U+202D (left-to-right override) import{a as e}from"./constants-B6wEjJhL.mjs";import{t}from"./logger-B-LXIf3U.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-KYaYveEQ.mjs";import{n as u,t as d}from"./fuzzyMatchColumns-Dym9eeQe.mjs";import{n as f,

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-DtdcpxcS.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjsView on unpkg

README.mdView file

1706patternName = generic_password severity = medium line = 1706 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L1706

2054patternName = generic_password severity = medium line = 2054 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2054

2630patternName = generic_password severity = medium line = 2630 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2630

2739patternName = generic_password severity = medium line = 2739 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2739

2754patternName = generic_password severity = medium line = 2754 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2754

3332patternName = generic_password severity = medium line = 3332 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3332

3343patternName = generic_password severity = medium line = 3343 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3343

3355patternName = generic_password severity = medium line = 3355 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3355

3367patternName = generic_password severity = medium line = 3367 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3367

3379patternName = generic_password severity = medium line = 3379 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3379

Findings

2 Critical12 Medium4 Low

CriticalTrojan Source Unicodedist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

90%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorTranscend Inc.

Maintainerscami-transcend, michaelfarrell76, bencmbrook +6

Version10.17.0

PublishedJul 1, 2026

LicenseApache-2.0

Dependencies39

Integrityverified

Package size961 KB

Files254

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.mjstypes → ./dist/index.d.mtsexports mapbin → __tr-build-xdi-sync-endpoint, __tr-consent-manager-service-json-to-yml, __tr-consent-managers-to-business-entities +9

Runtimenode >=22.12.0

Artifact5.41 MB · 254 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, build:watch, check:exports, check:publint +7

Behavioral surface

ChildProcessEnvironmentVarsFilesystemHighEntropyStringsMinifiedUrlStringsManifest: clean

Source & flagged code

12 flagged

dist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjsView file

Lines 1-2javascript

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjsView on unpkg · L1

2//# sourceMappingURL=uploadPrivacyRequestsFromCsv-DtdcpxcS.mjs.map

Long lines were clipped for display.

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-DtdcpxcS.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-DtdcpxcS.mjsView on unpkg

README.mdView file

Lines 1686-1726markdown

1686 --auth="$TRANSCEND_API_KEY" \

1687 --xdiLocation=https://cdn.your-site.com/xdi.js \

1688 --domainBlockList=ignored.com,localhost

1689```

1690

1691**Override XDI allowed commands**

1692

1693```sh

1694transcend consent build-xdi-sync-endpoint \

1695 --auth="$TRANSCEND_API_KEY" \

1696 --xdiLocation=https://cdn.your-site.com/xdi.js \

1697 --xdiAllowedCommands=ExtractIdentifiers:Simple

1698

Lines 2719-2774markdown

2719

2720**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2721

2722```sh

2723transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

2724```

2725

2726**Use dynamic variables to fill out parameters in YAML files (see [./examples/multi-instance.yml](./examples/multi-instance.yml))**

2727

2728```sh

2729transcend inventory push --auth="$TRANSCEND_API_KEY" --variables=domain:acme.com,stage:staging

2730```

2731

2732**Push a single .yml file configuration into multiple Transcend instances**

2733

2734This uses the output of [`transcend admin generate-api-keys`](#transcend-admin-generate-api-keys).

2735

2736```sh

2737transcend admin generate-api-keys \

2738 --email=test@transcend.io \

2739 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2739

2740 --scopes="View Email Templates,View Data Map" \

2741 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2742 --file=./transcend-api-keys.json

2743transcend inventory pull --auth="$TRANSCEND_API_KEY"

2744transcend inventory push --auth=./transcend-api-keys.json

2745```

2746

2747**Push multiple .yml file configurations into multiple Transcend instances**

2748

2749This uses the output of [`transcend admin generate-api-keys`](#transcend-admin-generate-api-keys).

2750

2751```sh

2752transcend admin generate-api-keys \

2753 --email=test@transcend.io \

2754 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2754

2755 --scopes="View Email Templates,View Data Map" \

2756 --apiKeyTitle="CLI Usage Cross Instance Sync" \

2757 --file=./transcend-api-keys.json

2758transcend inventory pull --auth=./transcend-api-keys.json --file=./transcend/

2759# <edit .yml files in folder in between these steps>

2760transcend inventory push --auth=./transcend-api-keys.json --file=./transcend/

2761```

2762

2763**Apply service classifier to all data flows**

2764

2765```sh

2766transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=dataFlows

2767transcend inventory push --auth="$TRANSCEND_API_KEY" --classifyService

2768```

2769

2770**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2771

2772```sh

2773transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=customFields

2774transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

Lines 3312-3363markdown

3312FLAGS

3313 --email The email address that you use to log into Transcend

3314 --password The password for your account login

3315 --apiKeyTitle The title of the API key being generated or destroyed

3316 --file The file where API keys should be written to

3318 [--deleteExistingApiKey/--noDeleteExistingApiKey] When true, if an API key exists with the specified apiKeyTitle, the existing API key is deleted [default = true]

3319 [--createNewApiKey/--noCreateNewApiKey] When true, new API keys will be created. Set to false if you simply want to delete all API keys with a title [default = true]

3320 [--parentOrganizationId] Filter for only a specific organization by ID, returning all child accounts associated with that organization

3321 [--transcendUrl] URL of the Transcend backend. Use https://api.us.transcend.io for US hosting [default = https://api.transcend.io]

3322 -h --help Print help information and exit

3323```

3324

3325#### Examples

3326

3327**Generate API keys for cross-instance usage**

3328

3329```sh

3330transcend admin generate-api-keys \

3331 --email=test@transcend.io \

3332 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3332

3333 --scopes="View Email Templates,View Data Map" \

3334 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3335 --file=./working/auth.json

3336```

3337

3338**Specifying the backend URL, needed for US hosted backend infrastructure**

3339

3340```sh

3341transcend admin generate-api-keys \

3342 --email=test@transcend.io \

3343 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3343

3344 --scopes="View Email Templates,View Data Map" \

3345 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3346 --file=./working/auth.json \

3347 --transcendUrl=https://api.us.transcend.io

3348```

3349

3350**Filter for only a specific organization by ID, returning all child accounts associated with that organization**

3351

3352```sh

3353transcend admin generate-api-keys \

3354 --email=test@transcend.io \

3355 --password="$TRANSCEND_PASSWORD" \

3356 --scopes="View Email Templates,View Data Map" \

3357 --apiKeyTitle="CLI Usage Cross Instance Sync" \

3358 --file=./working/auth.json \

3359 --parentOrganizationId=7098bb38-070d-4f26-8fa4-1b61b9cdef77

3360```

3361

3362**Delete all API keys with a certain title**

3363

Long lines were clipped for display.