registry / @zapier/zapier-sdk / 0.104.0
@zapier/zapier-sdk@0.104.0
Complete Zapier SDK - combines all Zapier SDK packages
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe flagged primitives are confined to normal SDK runtime features and are not activated by package installation. Source inspection found no lifecycle hook, self-dependency, opaque payload, destructive action, or credential exfiltration path.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Creating and using the SDK, or explicitly calling its URL-opening helper.
Impact
No unconsented installation mutation, secret harvesting, or arbitrary command execution was found.
Mechanism
Zapier API and telemetry requests plus a validated platform URL opener.
AI rationale
The flagged primitives are confined to normal SDK runtime features and are not activated by package installation. Source inspection found no lifecycle hook, self-dependency, opaque payload, destructive action, or credential exfiltration path.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The SDK emits runtime telemetry by default to a Zapier tracking endpoint, including lifecycle and limited authentication context.
- The URL helper can spawn a platform URL opener, but only for a caller-supplied HTTP or HTTPS URL.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook and no self-dependency.
- The child-process code validates the protocol and passes fixed commands with argument arrays; it does not execute shell text.
- Network and credential handling implement the advertised Zapier API and OAuth SDK functions; no secret harvesting or third-party exfiltration was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/chunk-CJKNVBRZ.mjsView file
2664async function loadChildProcess() {
L2665: return import(`${nodePrefix}child_process`);
L2666: }
High
Child Process
Package source references child process execution.
dist/chunk-CJKNVBRZ.mjsView on unpkg · L266410// src/constants.ts
L11: var ZAPIER_BASE_URL = globalThis.process?.env?.ZAPIER_BASE_URL || "https://zapier.com";
L12: function getZapierSdkService() {
...
L62: function getZapierDefaultApprovalMode() {
L63: const isInteractive = !!globalThis.process?.stdin?.isTTY && !!globalThis.process?.stdout?.isTTY;
L64: return isInteractive ? "poll" : "throw";
...
L550: }
L551: const base64UrlPattern = /^[A-Za-z0-9_-]+$/;
L552: return parts.every((part) => part.length > 0 && base64UrlPattern.test(part));
...
L675: headers: censorHeaders(options2?.headers),
L676: body: options2?.body && typeof options2.body === "string" ? (() => {
L677: try {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-CJKNVBRZ.mjsView on unpkg · L107439patternName = generic_password
severity = medium
line = 7439
Findings
1 Critical2 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/chunk-ZEZNG44W.cjs
HighChild Processdist/chunk-CJKNVBRZ.mjs
HighCommand Output Exfiltrationdist/chunk-CJKNVBRZ.mjs
MediumSecret Patterndist/chunk-CJKNVBRZ.mjs
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/chunk-ZEZNG44W.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @zapier/zapier-sdk@0.104.0.
See all versions of @zapier/zapier-sdk for other recorded verdicts.
- Review the evidence and your use of @zapier/zapier-sdk@0.104.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.