registry / @zapier/zapier-sdk-cli / 0.61.3

@zapier/zapier-sdk-cli@0.61.3

Command line interface for Zapier SDK

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 11 file(s), 1.15 MB of source, external domains: docs.zapier.com, hooks.zapier.com, zapier.com

Source & flagged code

5 flagged

dist/experimental.mjsView file

Lines 5-45javascript

5import { promises, createWriteStream, existsSync, readdirSync, rmSync, mkdirSync, writeFileSync, copyFileSync, readFileSync } from 'fs';

6import crypto, { createHash } from 'crypto';

7import * as path from 'path';

8import { resolve, join, dirname, basename, relative, extname } from 'path';

9import * as lockfile from 'proper-lockfile';

10import { definePlugin, createPluginMethod, OutputPropertySchema, ZapierBundleError, DEFAULT_CONFIG_PATH, ZapierValidationError, ZapierUnknownError, ZapierReleaseTriggerMessageSignal, getOrCreateApiClient, isPermanentHttpError, invalidateCachedToken, batch, toSnakeCase, ZapierAbortDrainSignal, isCredentialsObject, buildApplicationLifecycleEvent, AuthMechanism, ZapierAuthenticationError, ZapierError, DEPRECATION_NOTICE_EVENT } from '@zapier/zapier-sdk';

11import { z } from 'zod';

12import { injectCliLogin, createZapierSdkStack, createSdk, defineLegacyMerge, zapierSdkPlugin, addPlugin } from '@zapier/zapier-sdk/experimental';

13import { hostname } from 'os';

14import inquirer from 'inquirer';

15import express from 'express';

16import { createInterface } from 'readline/promises';

17import open from 'open';

18import chalk3 from 'chalk';

19import ora from 'ora';

20import pkceChallenge from 'pkce-challenge';

21import { startMcpServer } from '@zapier/zapier-sdk-mcp';

22import { buildSync } from 'esbuild';

23import { mkdir, writeFile, access } from 'fs/promises';

24import * as ts from 'typescript';

25import 'is-installed-globally';

26import { execSync, spawn } from 'child_process';

27import Handlebars from 'handlebars';

High

Child Process

Package source references child process execution.

dist/experimental.mjsView on unpkg · L25

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/experimental.mjsView on unpkg · L25

28import { fileURLToPath } from 'url';

29import 'wrap-ansi';

31var __defProp = Object.defineProperty;

32var __export = (target, all) => {

33 for (var name in all)

34 __defProp(target, name, { get: all[name], enumerable: true });

35};

37// src/login.ts

38var login_exports = {};

39__export(login_exports, {

40 AUTH_MODE_HEADER: () => AUTH_MODE_HEADER,

41 DEFAULT_AUTH_BASE_URL: () => DEFAULT_AUTH_BASE_URL,

42 ZapierAuthenticationError: () => ZapierAuthenticationError,

43 clearTokensFromKeychain: () => clearTokensFromKeychain,

44 createCache: () => createCache,

45 getActiveCredentials: () => getActiveCredentials,

Lines 3787-3827javascript

3787 const projectName = toProjectName(rawName);

3788 if (!projectName) {

3789 throw new Error(

3790 `"${rawName}" results in an empty project name. Provide a name with at least one letter or number.`

3791 );

3792 }

3793 const projectDir

Lines 4266-4306javascript

4266 }

4267 if (action === "view") {

4268 console.log(chalk3.dim(JSON.stringify(message.payload, null, 2)));

4269 continue;

4270 }

4271 if (action === "ack") {

4272

dist/login.cjsView file

Lines 1-22javascript

1'use strict';

3var jwt = require('jsonwebtoken');

4var crossKeychain = require('cross-keychain');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/login.cjsView on unpkg · L2

5var Conf = require('conf'

Source & flagged code

5 flagged · loading source

dist/experimental.mjsView file

25import 'is-installed-globally'; L26: import { execSync, spawn } from 'child_process'; L27: import Handlebars from 'handlebars';

High

Child Process

Package source references child process execution.

dist/experimental.mjsView on unpkg · L25

3807stdio: "inherit", L3808: shell: process.platform === "win32" ? "cmd.exe" : "/bin/sh" L3809: });

High

Shell

Package source references shell execution.

dist/experimental.mjsView on unpkg · L3807

4286function createNdjsonCallback() { L4287: return (message) => new Promise((resolve4, reject) => { L4288: process.stdout.write(JSON.stringify(message) + "\n", (err) => { L4289: if (err) reject(err); ... L4296: return new Promise((resolve4, reject) => { L4297: const child = spawn(command, args, { L4298: shell,

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/experimental.mjsView on unpkg · L4286

25import 'is-installed-globally'; L26: import { execSync, spawn } from 'child_process'; L27: import Handlebars from 'handlebars'; ... L94: try { L95: parsed = JSON.parse(raw); L96: } catch { ... L133: } L134: var DEFAULT_AUTH_BASE_URL = "https://zapier.com"; L135: var config = null; ... L299: this.code = "ZAPIER_CLI_USER_CANCELLATION"; L300: this.exitCode = 0; L301: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/experimental.mjsView on unpkg · L25

dist/login.cjsView file

2L3: var jwt = require('jsonwebtoken'); L4: var crossKeychain = require('cross-keychain');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/login.cjsView on unpkg · L2

Findings

3 High3 Medium6 Low

HighChild Processdist/experimental.mjs

HighShelldist/experimental.mjs

HighCommand Output Exfiltrationdist/experimental.mjs

MediumDynamic Requiredist/login.cjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/experimental.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/experimental.mjsView file

Lines 5-45javascript

5import { promises, createWriteStream, existsSync, readdirSync, rmSync, mkdirSync, writeFileSync, copyFileSync, readFileSync } from 'fs';

6import crypto, { createHash } from 'crypto';

7import * as path from 'path';

8import { resolve, join, dirname, basename, relative, extname } from 'path';

9import * as lockfile from 'proper-lockfile';

11import { z } from 'zod';

12import { injectCliLogin, createZapierSdkStack, createSdk, defineLegacyMerge, zapierSdkPlugin, addPlugin } from '@zapier/zapier-sdk/experimental';

13import { hostname } from 'os';

14import inquirer from 'inquirer';

15import express from 'express';

16import { createInterface } from 'readline/promises';

17import open from 'open';

18import chalk3 from 'chalk';

19import ora from 'ora';

20import pkceChallenge from 'pkce-challenge';

21import { startMcpServer } from '@zapier/zapier-sdk-mcp';

22import { buildSync } from 'esbuild';

23import { mkdir, writeFile, access } from 'fs/promises';

24import * as ts from 'typescript';

25import 'is-installed-globally';

26import { execSync, spawn } from 'child_process';

27import Handlebars from 'handlebars';

High

Child Process

Package source references child process execution.

dist/experimental.mjsView on unpkg · L25

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/experimental.mjsView on unpkg · L25

28import { fileURLToPath } from 'url';

29import 'wrap-ansi';

31var __defProp = Object.defineProperty;

32var __export = (target, all) => {

33 for (var name in all)

34 __defProp(target, name, { get: all[name], enumerable: true });

35};

37// src/login.ts

38var login_exports = {};

39__export(login_exports, {

40 AUTH_MODE_HEADER: () => AUTH_MODE_HEADER,

41 DEFAULT_AUTH_BASE_URL: () => DEFAULT_AUTH_BASE_URL,

42 ZapierAuthenticationError: () => ZapierAuthenticationError,

43 clearTokensFromKeychain: () => clearTokensFromKeychain,

44 createCache: () => createCache,

45 getActiveCredentials: () => getActiveCredentials,

Lines 3787-3827javascript

3787 const projectName = toProjectName(rawName);

3788 if (!projectName) {

3789 throw new Error(

3790 `"${rawName}" results in an empty project name. Provide a name with at least one letter or number.`

3791 );

3792 }

3793 const projectDir

Lines 4266-4306javascript

4266 }

4267 if (action === "view") {

4268 console.log(chalk3.dim(JSON.stringify(message.payload, null, 2)));

4269 continue;

4270 }

4271 if (action === "ack") {

4272

dist/login.cjsView file

Lines 1-22javascript

1'use strict';

3var jwt = require('jsonwebtoken');

4var crossKeychain = require('cross-keychain');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/login.cjsView on unpkg · L2

5var Conf = require('conf'