registry / @zapier/zapier-sdk / 0.107.2
@zapier/zapier-sdk@0.107.2
Complete Zapier SDK - combines all Zapier SDK packages
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection shows a normal SDK with no lifecycle hooks. The flagged child-process code is limited to opening validated web URLs, and its network behavior is package-aligned OAuth/API functionality.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer invokes an SDK authentication, connection, or approval method.
Impact
No install-time execution, data harvesting, persistence, or command-output exfiltration was found.
Mechanism
Authenticated Zapier API requests and constrained browser URL opening.
AI rationale
Static inspection shows a normal SDK with no lifecycle hooks. The flagged child-process code is limited to opening validated web URLs, and its network behavior is package-aligned OAuth/API functionality.
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no automatic install lifecycle hook or self-dependency.
- The flagged ESM child-process path only opens validated HTTP(S) URLs with fixed platform URL launchers.
- The flagged CJS file contains the same constrained browser-opening implementation.
- Network use is an OAuth client-credentials request made with SDK-supplied options.
Evidence against
- The SDK reads environment configuration and makes authenticated HTTP requests when its API is used.
- Connection and approval workflows may open a browser.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/chunk-HYFM3H36.mjsView file
2873async function loadChildProcess() {
L2874: return import(`${nodePrefix}child_process`);
L2875: }
High
Child Process
Package source references child process execution.
dist/chunk-HYFM3H36.mjsView on unpkg · L287310// src/constants.ts
L11: var ZAPIER_BASE_URL = globalThis.process?.env?.ZAPIER_BASE_URL || "https://zapier.com";
L12: function getZapierSdkService() {
...
L68: function getZapierDefaultApprovalMode() {
L69: const isInteractive = !!globalThis.process?.stdin?.isTTY && !!globalThis.process?.stdout?.isTTY;
L70: return isInteractive ? "poll" : "throw";
...
L556: }
L557: const base64UrlPattern = /^[A-Za-z0-9_-]+$/;
L558: return parts.every((part) => part.length > 0 && base64UrlPattern.test(part));
...
L681: headers: censorHeaders(options2?.headers),
L682: body: options2?.body && typeof options2.body === "string" ? (() => {
L683: try {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-HYFM3H36.mjsView on unpkg · L107660patternName = generic_password
severity = medium
line = 7660
Findings
1 Critical2 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/chunk-Y7CGEGII.cjs
HighChild Processdist/chunk-HYFM3H36.mjs
HighCommand Output Exfiltrationdist/chunk-HYFM3H36.mjs
MediumSecret Patterndist/chunk-HYFM3H36.mjs
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/chunk-Y7CGEGII.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @zapier/zapier-sdk@0.107.2.
See all versions of @zapier/zapier-sdk for other recorded verdicts.
- Review the evidence and your use of @zapier/zapier-sdk@0.107.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.