registry / @withone/cli / 1.57.1
@withone/cli@1.57.1
CLI for managing One
AI Security Review
scanned 12d ago · by lpm-firewall-aiInspected source resolves the credential and persistence signals to user-configured API use, optional OpenAI embeddings, disclosed opt-out analytics, and a same-package updater. These behaviors do not establish malicious activity.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Normal CLI command execution; OpenAI requests require OpenAI embeddings to be enabled.
Impact
No confirmed harmful effect was found; the updater replaces this CLI with a newer npm release, and analytics reports account-linked command usage.
Mechanism
The source routes One credentials to the configured One API, OpenAI keys to the OpenAI embeddings endpoint, and usage rollups to the analytics service with a stated opt-out.
AI rationale
Inspected source resolves the credential and persistence signals to user-configured API use, optional OpenAI embeddings, disclosed opt-out analytics, and a same-package updater. These behaviors do not establish malicious activity.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and its prepare script runs only the build tool; bin/cli.js imports the declared CLI entrypoint.
- The One API key setup offers the user a custom endpoint, asks for a key for that endpoint, validates it there, then saves that endpoint with the key.
- OpenAI embedding requests use the OpenAI API key only when the embedding provider is configured as OpenAI, and send it to api.openai.com.
- The CLI checks for updates after commands and can install a newer release of @withone/cli from npm; the source includes an opt-out and an age gate.
- Inspected dependency entrypoints are prompt, color-formatting, and command-parsing libraries; no harmful behavior was found in their cited source.
- Analytics notice says usage is linked to the One account and can be disabled; telemetry records command rollups and account profile fields, not command arguments or secrets.
Evidence against
- Default analytics includes account-linked usage and may attach the account email and name to its event profile; this is disclosed in the CLI notice and can be disabled.
Behavioral surface
Source & flagged code
11 flaggeddist/chunk-IMU2X3ZV.jsView file
1465import { createRequire } from "module";
L1466: import { spawn, spawnSync } from "child_process";
L1467: var requireFromHere = createRequire(import.meta.url);
High
Child Process
Package source references child process execution.
dist/chunk-IMU2X3ZV.jsView on unpkg · L14651773patternName = generic_password
severity = medium
line = 1773
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-IMU2X3ZV.jsView on unpkg · L17731310if (this.backend) return this.backend;
L1311: const pg = await import("pg").catch((err) => {
L1312: const msg = err instanceof Error ? err.message : String(err);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/chunk-IMU2X3ZV.jsView on unpkg · L1310dist/index.js
Findings
1 Critical5 High6 Medium9 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/chunk-IMU2X3ZV.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumSecret Patterndist/chunk-IMU2X3ZV.js
MediumDynamic Requiredist/chunk-IMU2X3ZV.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @withone/cli@1.57.1.
See all versions of @withone/cli for other recorded verdicts.
- Review the evidence and your use of @withone/cli@1.57.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.