registry / @zapier/zapier-sdk-cli / 0.65.7

@zapier/zapier-sdk-cli@0.65.7

⚠ Under review

Command line interface for Zapier SDK

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 11 file(s), 1.23 MB of source, external domains: docs.zapier.com, hooks.zapier.com, zapier.com

Source & flagged code

6 flagged

dist/experimental.mjsView file

Lines 5-45javascript

5import { promises, createWriteStream, existsSync, readdirSync, rmSync, mkdirSync, writeFileSync, copyFileSync, readFileSync } from 'fs';

6import crypto, { createHash } from 'crypto';

7import * as path from 'path';

8import { resolve, join, dirname, basename, relative, extname } from 'path';

9import * as lockfile from 'proper-lockfile';

10import { defineMethod, apiPluginRef, resolveCredentialsPluginRef, eventEmissionPluginRef, sdkOptionsPluginRef, declareOptionalProperty, OutputPropertySchema, ZapierBundleError, DEFAULT_CONFIG_PATH, declareMethod, ZapierValidationError, ZapierUnknownError, manifestPluginRef, defineResolver, defineMethodOverride, zapierCoreOptions, injectCliLogin, definePlugin, omitExports, zapierSdkPlugin, isPermanentHttpError, invalidateCachedToken, batch, toSnakeCase, ZapierError, ZapierReleaseTriggerMessageSignal, getOrCreateApiClient, isCredentialsObject, ZapierAuthenticationError, ZapierAbortDrainSignal, b ...

11import { z } from 'zod';

12import { triggerInboxResolver, DrainTriggerInboxSchema, WatchTriggerInboxSchema, injectCliLogin as injectCliLogin$1, definePlugin as definePlugin$1, omitExports as omitExports$1, zapierExperimentalSdkPlugin, createSdk, CORE_OPTIONS_ID, SDK_OPTIONS_ID, addPlugin } from '@zapier/zapier-sdk/experimental';

13import { hostname } from 'os';

14import inquirer from 'inquirer';

15import express from 'express';

16import { createInterface } from 'readline/promises';

17import open from 'open';

18import chalk3 from 'chalk';

19import ora from 'ora';

20import pkceChallenge from 'pkce-challenge';

21import { startMcpServer } from '@zapier/zapier-sdk-mcp';

22import { buildSync } from 'esbuild';

23import { mkdir, writeFile, access } from 'fs/promises';

24import * as ts from 'typescript';

25import 'is-installed-globally';

26import { execSync, spawn } from 'child_process';

27import Handlebars from 'handlebars';

High

Child Process

Package source references child process execution.

dist/experimental.mjsView on unpkg · L25

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/experimental.mjsView on unpkg · L25

28import { fileURLToPath } from 'url';

29import 'wrap-ansi';

31var __defProp = Object.defineProperty;

32var __export = (target, all) => {

33 for (var name in all)

34 __defProp(target, name, { get: all[name], enumerable: true });

35};

37// src/login.ts

38var login_exports = {};

39__export(login_exports, {

40 AUTH_MODE_HEADER: () => AUTH_MODE_HEADER,

41 DEFAULT_AUTH_BASE_URL: () => DEFAULT_AUTH_BASE_URL,

42 ZapierAuthenticationError: () => ZapierAuthenticationError,

43 clearTokensFromKeychain: () => clearTokensFromKeychain,

44 createCache: () => createCache,

45 getActiveCredentials: () => getActiveCredentials,

Long lines were clipped for display.

Lines 4148-4188javascript

4148 const projectName = toProjectName(rawName);

4149 if (!projectName) {

4150 throw new Error(

4151 `"${rawName}" results in an empty project name. Provide a name with at least one letter or number.`

4152 );

4153 }

4154 const projectDir

Lines 4632-4672javascript

4632 }

4633 if (action === "view") {

4634 console.log(chalk3.dim(JSON.stringify(message.payload, null, 2)));

4635 continue;

4636 }

4637 if (action === "ack") {

4638

dist/login.cjsView file

Lines 1-22javascript

1'use strict';

3var jwt = require('jsonwebtoken');

4var crossKeychain = require('cross-keychain');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/login.cjsView on unpkg · L2

5var Conf = require('conf'

dist/cli.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zapier/zapier-sdk-cli@0.62.0 matchedIdentity = npm:QHphcGllci96YXBpZXItc2RrLWNsaQ:0.62.0 similarity = 0.545 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.cjsView on unpkg

Source & flagged code

6 flagged · loading source

dist/experimental.mjsView file

25import 'is-installed-globally'; L26: import { execSync, spawn } from 'child_process'; L27: import Handlebars from 'handlebars';

High

Child Process

Package source references child process execution.

dist/experimental.mjsView on unpkg · L25

4168stdio: "inherit", L4169: shell: process.platform === "win32" ? "cmd.exe" : "/bin/sh" L4170: });

High

Shell

Package source references shell execution.

dist/experimental.mjsView on unpkg · L4168

4652function createNdjsonCallback() { L4653: return (message) => new Promise((resolve4, reject) => { L4654: process.stdout.write(JSON.stringify(message) + "\n", (err) => { L4655: if (err) reject(err); ... L4662: return new Promise((resolve4, reject) => { L4663: const child = spawn(command, args, { L4664: shell,

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/experimental.mjsView on unpkg · L4652

25import 'is-installed-globally'; L26: import { execSync, spawn } from 'child_process'; L27: import Handlebars from 'handlebars'; ... L94: try { L95: parsed = JSON.parse(raw); L96: } catch { ... L133: } L134: var DEFAULT_AUTH_BASE_URL = "https://zapier.com"; L135: var config = null; ... L299: this.code = "ZAPIER_CLI_USER_CANCELLATION"; L300: this.exitCode = 0; L301: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/experimental.mjsView on unpkg · L25

dist/login.cjsView file

2L3: var jwt = require('jsonwebtoken'); L4: var crossKeychain = require('cross-keychain');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/login.cjsView on unpkg · L2

dist/cli.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.cjsView on unpkg

Findings

1 Critical3 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.cjs

HighChild Processdist/experimental.mjs

HighShelldist/experimental.mjs

HighCommand Output Exfiltrationdist/experimental.mjs

MediumDynamic Requiredist/login.cjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/experimental.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/experimental.mjsView file

Lines 5-45javascript

5import { promises, createWriteStream, existsSync, readdirSync, rmSync, mkdirSync, writeFileSync, copyFileSync, readFileSync } from 'fs';

6import crypto, { createHash } from 'crypto';

7import * as path from 'path';

8import { resolve, join, dirname, basename, relative, extname } from 'path';

9import * as lockfile from 'proper-lockfile';

11import { z } from 'zod';

13import { hostname } from 'os';

14import inquirer from 'inquirer';

15import express from 'express';

16import { createInterface } from 'readline/promises';

17import open from 'open';

18import chalk3 from 'chalk';

19import ora from 'ora';

20import pkceChallenge from 'pkce-challenge';

21import { startMcpServer } from '@zapier/zapier-sdk-mcp';

22import { buildSync } from 'esbuild';

23import { mkdir, writeFile, access } from 'fs/promises';

24import * as ts from 'typescript';

25import 'is-installed-globally';

26import { execSync, spawn } from 'child_process';

27import Handlebars from 'handlebars';

High

Child Process

Package source references child process execution.

dist/experimental.mjsView on unpkg · L25

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/experimental.mjsView on unpkg · L25

28import { fileURLToPath } from 'url';

29import 'wrap-ansi';

31var __defProp = Object.defineProperty;

32var __export = (target, all) => {

33 for (var name in all)

34 __defProp(target, name, { get: all[name], enumerable: true });

35};

37// src/login.ts

38var login_exports = {};

39__export(login_exports, {

40 AUTH_MODE_HEADER: () => AUTH_MODE_HEADER,

41 DEFAULT_AUTH_BASE_URL: () => DEFAULT_AUTH_BASE_URL,

42 ZapierAuthenticationError: () => ZapierAuthenticationError,

43 clearTokensFromKeychain: () => clearTokensFromKeychain,

44 createCache: () => createCache,

45 getActiveCredentials: () => getActiveCredentials,

Long lines were clipped for display.

Lines 4148-4188javascript

4148 const projectName = toProjectName(rawName);

4149 if (!projectName) {

4150 throw new Error(

4151 `"${rawName}" results in an empty project name. Provide a name with at least one letter or number.`

4152 );

4153 }

4154 const projectDir

Lines 4632-4672javascript

4632 }

4633 if (action === "view") {

4634 console.log(chalk3.dim(JSON.stringify(message.payload, null, 2)));

4635 continue;

4636 }

4637 if (action === "ack") {

4638

dist/login.cjsView file

Lines 1-22javascript

1'use strict';

3var jwt = require('jsonwebtoken');

4var crossKeychain = require('cross-keychain');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/login.cjsView on unpkg · L2

5var Conf = require('conf'

dist/cli.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.cjsView on unpkg