registry / @withone/cli / 1.56.1
@withone/cli@1.56.1
⚠ Under reviewCLI for managing One
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe suspicious credential-redirection hint is not supported by the inspected login flow: custom destinations are selected interactively and the entered key is validated against that destination. The embedded backend launches pgserve, but its source was unavailable in the reviewed snapshot, so this unresolved runtime dependency prevents a clean verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A command that initializes the default embedded memory database.
Impact
No malicious effect is established, but the launched dependency remains an unresolved executable boundary.
Mechanism
The backend resolves the pgserve wrapper and launches it as a detached child process; the dependency’s behavior could not be checked.
AI rationale
The suspicious credential-redirection hint is not supported by the inspected login flow: custom destinations are selected interactively and the entered key is validated against that destination. The embedded backend launches pgserve, but its source was unavailable in the reviewed snapshot, so this unresolved runtime dependency prevents a clean verdict.
Evidence
package.jsondist/chunk-VH46MAE4.js.one/pg.pgserve.jsonpgserve.log
Network endpoints1
127.0.0.1:5434
Decision evidence
public snapshotAI called this Manual Review at 88.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json lists pgserve as a runtime dependency; the prepare script runs the project bundler, and the CLI entry points to dist/index.js.
- The embedded backend resolves and launches pgserve as a detached child during backend initialization. Its default listener is 127.0.0.1:5434, but pgserve’s implementation was not available in the inspected snapshot.
- The credential redirect hint was not confirmed: custom API setup asks for an endpoint and validates the key against that endpoint; browser login uses the configured API base.
Evidence against
- The inspected source shows the database listener bound to localhost and stores its data and logs under the One data directory.
- The package’s prepare command is a build step, not a credential-transfer or persistence hook.
- The reviewed login flow does not show a hidden transfer to an unrelated fixed recipient.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
Source & flagged code
10 flaggeddist/chunk-VH46MAE4.jsView file
1462import { createRequire } from "module";
L1463: import { spawn } from "child_process";
L1464: var requireFromHere = createRequire(import.meta.url);
High
Child Process
Package source references child process execution.
dist/chunk-VH46MAE4.jsView on unpkg · L14621310if (this.backend) return this.backend;
L1311: const pg = await import("pg").catch((err) => {
L1312: const msg = err instanceof Error ? err.message : String(err);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-VH46MAE4.jsView on unpkg · L1310dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @withone/cli@1.53.0
matchedIdentity = npm:QHdpdGhvbmUvY2xp:1.53.0
similarity = 0.813
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Findings
1 Critical5 High5 Medium9 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/chunk-VH46MAE4.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumDynamic Requiredist/chunk-VH46MAE4.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
Affected versions and remediation
This report applies to @withone/cli@1.56.1.
See all versions of @withone/cli for other recorded verdicts.
- Review the evidence and your use of @withone/cli@1.56.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.