registry / @transcend-io/cli / 10.17.0

@transcend-io/cli@10.17.0

⚠ Under review

A command line interface for programmatic operations across Transcend.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 124 file(s), 341 KB of source, external domains: api.transcend.io, api.us.transcend.io, app.transcend.io, consent.transcend.io, consent.us.transcend.io, docs.transcend.io, github.com, www.openpolicyagent.org

Source & flagged code

13 flagged

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView file

Lines 1-2javascript

1import{a as e}from"./constants-BeMH_MWn.mjs";import{t}from"./logger-D1tXVwJj.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-BSZc6Ifl.mjs";import{n as u,t

Source & flagged code

13 flagged · loading source

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView file

1contains invisible/control Unicode U+202D (left-to-right override) import{a as e}from"./constants-BeMH_MWn.mjs";import{t}from"./logger-D1tXVwJj.mjs";import{a as n,c as r,i,l as a,o,r as s,s as c,t as l}from"./constants-BSZc6Ifl.mjs";import{n as u,t as d}from"./fuzzyMatchColumns-jgLi9Qnf.mjs";import{n as f,

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> dist/index.mjs -> [redacted]-DFKHnc0H.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjsView on unpkg

dist/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @transcend-io/cli@10.12.2 matchedIdentity = npm:QHRyYW5zY2VuZC1pby9jbGk:10.12.2 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

README.mdView file

1720patternName = generic_password severity = medium line = 1720 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L1720

2068patternName = generic_password severity = medium line = 2068 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2068

2645patternName = generic_password severity = medium line = 2645 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2645

2755patternName = generic_password severity = medium line = 2755 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2755

2770patternName = generic_password severity = medium line = 2770 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L2770

3357patternName = generic_password severity = medium line = 3357 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3357

3368patternName = generic_password severity = medium line = 3368 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3368

3380patternName = generic_password severity = medium line = 3380 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3380

3392patternName = generic_password severity = medium line = 3392 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3392

3404patternName = generic_password severity = medium line = 3404 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3404

Findings

3 Critical12 Medium4 Low

CriticalTrojan Source Unicodedist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/uploadPrivacyRequestsFromCsv-DFKHnc0H.mjs

CriticalPrevious Version Dangerous Deltadist/index.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

README.mdView file

Lines 1700-1740markdown

1700 --auth="$TRANSCEND_API_KEY" \

1701 --xdiLocation=https://cdn.your-site.com/xdi.js \

1702 --domainBlockList=ignored.com,localhost

1703```

1704

1705**Override XDI allowed commands**

1706

1707```sh

1708transcend consent build-xdi-sync-endpoint \

1709 --auth="$TRANSCEND_API_KEY" \

1710 --xdiLocation=https://cdn.your-site.com/xdi.js \

1711 --xdiAllowedCommands=ExtractIdentifiers:Simple

1712```

1713

1714**Configuring across multiple Transcend Instances**

1715

1716```sh

1717# Pull down API keys across all Transcend instances

1718transcend admin generate-api-keys \

1719 --email="$TRANSCEND_EMAIL" \

1720 --password="$TRANSCEND_PASSWORD" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L1720

1721 --transcendUrl=https://api.us.transcend.io \

1722 --scopes="View Consent Manager" \

1723 --apiKeyTitle="[cli][$TRANSCEND_EMAIL] XDI Endpoint Construction" \

1724 --file=./api-keys.json \

1725 --parentOrganizationId=1821d872-6114-406e-90c3-73b4d5e246cf

1726

1727# Path list of API keys as authentication

1728transcend consent build-xdi-sync-endpoint \

1729 --auth=./api-keys.json \

1730 --xdiLocation=https://cdn.your-site.com/xdi.js \

1731 --transcendUrl=https://api.us.transcend.io

1732```

1733

1734### `transcend consent generate-access-tokens`

1735

1736```txt

1737USAGE

1738 transcend consent generate-access-tokens (--auth value) (--file value) (--subjectType value) [--emailColumnName value] [--coreIdentifierColumnName value] [--duration value] [--transcendUrl value]

1739 transcend consent generate-access-tokens --help

1740

Lines 2048-2088markdown

2048transcend consent update-consent-manager --auth="$TRANSCEND_API_KEY" --deploy

2049```

2050

2051**Update just the TEST bundle**

2052

2053```sh

2054transcend consent update-consent-manager --auth="$TRANSCEND_API_KEY" --bundleTypes=TEST

2055```

2056

2057**Update just the PRODUCTION bundle**

2058

2059```sh

2060transcend consent update-consent-manager --auth="

Lines 2625-2665markdown

2625transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=privacyCenters,messages

2626```

2627

2628**Pull assessments and assessment templates**

2629

2630```sh

2631transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=assessments,assessmentTemplates

2632```

2633

2634**Pull everything**

2635

2636```sh

2637transcend inventory pull --auth="

Lines 2735-2790markdown

2735

2736**Push up attributes, deleting any attributes that are not specified in the transcend.yml file**

2737

2738```sh

2739transcend inventory push --auth="$TRANSCEND_API_KEY" --deleteExtraAttributeValues

2740```

2741

2742**Use dynamic variables to fill out parameters in YAML files (see [./examples/multi-instance.yml](./examples/multi-instance.yml))**

2743

2744```sh

Lines 3337-3388markdown

3337FLAGS

3338 --email The email address that you use to log into Transcend

3339 --password The password for your account login

3340 --apiKeyTitle The title of the API key being generated or destroyed

3341 --file The file where API keys should be written to

3343 [--deleteExistingApiKey/--noDeleteExistingApiKey] When true, if an API key exists with the specified apiKeyTitle, the existing API key is deleted [default = true]

3344 [--createNewApiKey/--noCreateNewApiKey

3380patternName = generic_password severity = medium line = 3380 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3380

3392patternName = generic_password severity = medium line = 3392 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3392

3404patternName = generic_password severity = medium line = 3404 matchedText = --passwo...D" \

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L3404