registry / @trayai/helix-cli / 1.13.0
@trayai/helix-cli@1.13.0
Helix CLI — helix init, helix dev, helix auth
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged CLI behavior is consistent with Helix's purpose: brokered requests use the user's local Tray login and an upstream URL supplied to the tool. The reviewed telemetry is documented, install hooks are absent, and no fixed foreign credential destination or automatic exfiltration was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI commands and MCP tools run when explicitly invoked; analytics is tied to documented CLI operations.
Impact
No concrete malicious impact identified.
Mechanism
No hidden credential redirect or command-output exfiltration was found. Credentialed upstream requests go through the Tray broker using a caller-supplied URL.
AI rationale
The flagged CLI behavior is consistent with Helix's purpose: brokered requests use the user's local Tray login and an upstream URL supplied to the tool. The reviewed telemetry is documented, install hooks are absent, and no fixed foreign credential destination or automatic exfiltration was found.
Network endpoints3
registry.npmjs.orgTray region API host resolved by @trayai/helix-sdkCaller-supplied HTTPS upstream URL via the Tray credential broker
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/cli.js as the helix command and has no install lifecycle hooks; dist/index.js only re-exports error classes.
- Runtime analytics reports command outcomes, runtime details, and Tray-assigned project identifiers to the Tray analytics path; the changelog discloses analytics and says it excludes source, arguments, paths, and credentials.
- The credential-broker MCP tool is invoked with a caller-supplied HTTPS URL and uses the local Tray login; its description says the broker injects credentials server-side.
- The credential-broker operation requires an explicit MCP tool call and local Tray login; no fixed unofficial credential destination or automatic credential forwarding was identified.
Evidence against
- The MCP tool can forward a configured credential to an HTTPS upstream URL supplied in its input when invoked; this is described as a way to test or call the user's intended upstream API.
- The CLI executes child-process operations, but no unrelated command-output collection or outbound exfiltration path was identified.
Behavioral surface
Source & flagged code
8 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @trayai/helix-cli@0.65.0
matchedIdentity = npm:QHRyYXlhaS9oZWxpeC1jbGk:0.65.0
similarity = 0.625
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg161Open this link to create ${t}:`),console.log(e.url),console.error(`
L162: Press enter once you've finished in the browser.`)}function Jc(e){return tn({message:"Finished in the browser?",default:!0})}async function Zc(e){return Hc({message:"Alias for this...
L163: Create it (copy your helix.config.ts and point it at the ${t.target} workspace and project), then re-run \`helix ci init\`.`)}async function pl(e,t,r,o,n){let i=await n(e,{configFi...
High
219CI setup failed: ${c}
L220: `),process.exit(1)}})}import{readFile as bp}from"fs/promises";import{Option as Cp}from"commander";import{loadConfig as Pp,requireWorkspaceId as Ap,resolveConfigOverride as Sr,WORKS...
L221: ${t.join(`
...
L223:
L224: Reinstall to pick older versions (delete the lockfile, then install again \u2014 new projects carry an install age limit that avoids this), pin an older version, or redeploy after ...
L225: \u2713 Workspace "${je.name}" created`);try{await B(l,je.id,{configFile:c})}catch(Cs){throw Tt(je,Cs)}console.log(` \u21B3 workspaceId ${je.id} written to ${Sr(c)??"helix.config.t...
...
L228: ${g}
L229: `:typeof h=="string"?`Deploy failed [${h}]: ${g}`:`Deploy failed: ${g}`),await u("failure",m instanceof Error&&m.name?m.name:"Error"),process.exit(1)}})}
Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/templates/project/_helix/hooks/helix-activate.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
Low
Affected versions and remediation
This report applies to @trayai/helix-cli@1.13.0.
See all versions of @trayai/helix-cli for other recorded verdicts.
- Review the evidence and your use of @trayai/helix-cli@1.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.