registry / @zapier/zapier-sdk / 0.111.1
@zapier/zapier-sdk@0.111.1
⚠ Under reviewComplete Zapier SDK - combines all Zapier SDK packages
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/chunk-GVGPB4RI.mjsView file
2805async function loadChildProcess() {
L2806: return import(`${nodePrefix}child_process`);
L2807: }
High
Child Process
Package source references child process execution.
dist/chunk-GVGPB4RI.mjsView on unpkg · L280511// src/constants.ts
L12: var ZAPIER_BASE_URL = globalThis.process?.env?.ZAPIER_BASE_URL || "https://zapier.com";
L13: function getZapierSdkService() {
...
L69: function getZapierDefaultApprovalMode() {
L70: const isInteractive = !!globalThis.process?.stdin?.isTTY && !!globalThis.process?.stdout?.isTTY;
L71: return isInteractive ? "poll" : "throw";
...
L557: }
L558: const base64UrlPattern = /^[A-Za-z0-9_-]+$/;
L559: return parts.every((part) => part.length > 0 && base64UrlPattern.test(part));
...
L759: headers: censorHeaders(options2?.headers),
L760: body: options2?.body && typeof options2.body === "string" ? (() => {
L761: try {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-GVGPB4RI.mjsView on unpkg · L118017patternName = generic_password
severity = medium
line = 8017
Findings
2 High4 Medium5 Low
HighChild Processdist/chunk-GVGPB4RI.mjs
HighCommand Output Exfiltrationdist/chunk-GVGPB4RI.mjs
MediumSecret Patterndist/chunk-GVGPB4RI.mjs
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/chunk-PEPMWTX3.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @zapier/zapier-sdk@0.111.1.
See all versions of @zapier/zapier-sdk for other recorded verdicts.
- Review the evidence and your use of @zapier/zapier-sdk@0.111.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.