registry / @zapier/zapier-sdk / 0.112.0
@zapier/zapier-sdk@0.112.0
Complete Zapier SDK - combines all Zapier SDK packages
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest contains no install lifecycle hook, and the flagged child-process use belongs to a URL-opening helper that restricts URLs to HTTP(S). The required flagged-file and declaration coverage did not reveal a concrete attack surface.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A caller invokes the URL-opening helper.
Impact
No confirmed harmful effect or credential transfer was identified.
Mechanism
The helper validates the URL scheme and opens the URL using the platform browser command.
AI rationale
The manifest contains no install lifecycle hook, and the flagged child-process use belongs to a URL-opening helper that restricts URLs to HTTP(S). The required flagged-file and declaration coverage did not reveal a concrete attack surface.
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json lists build and development scripts but no install lifecycle hooks.
- The CommonJS URL helper rejects non-HTTP(S) URLs before opening them.
- The CommonJS helper uses platform browser-opening commands with the caller-supplied URL.
- The ESM URL helper applies the same HTTP(S) restriction.
- The experimental declaration files import SDK types; no executable behavior is shown in these declarations.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/chunk-22F3PGAC.cjsView file
2814async function loadChildProcess() {
L2815: return import(`${nodePrefix}child_process`);
L2816: }
High
Child Process
Package source references child process execution.
dist/chunk-22F3PGAC.cjsView on unpkg · L281412// src/constants.ts
L13: var ZAPIER_BASE_URL = globalThis.process?.env?.ZAPIER_BASE_URL || "https://zapier.com";
L14: function getZapierSdkService() {
...
L70: function getZapierDefaultApprovalMode() {
L71: const isInteractive = !!globalThis.process?.stdin?.isTTY && !!globalThis.process?.stdout?.isTTY;
L72: return isInteractive ? "poll" : "throw";
...
L558: }
L559: const base64UrlPattern = /^[A-Za-z0-9_-]+$/;
L560: return parts.every((part) => part.length > 0 && base64UrlPattern.test(part));
...
L760: headers: censorHeaders(options2?.headers),
L761: body: options2?.body && typeof options2.body === "string" ? (() => {
L762: try {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-22F3PGAC.cjsView on unpkg · L128030patternName = generic_password
severity = medium
line = 8030
Findings
1 Critical2 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/chunk-PQB6IXXA.mjs
HighChild Processdist/chunk-22F3PGAC.cjs
HighCommand Output Exfiltrationdist/chunk-22F3PGAC.cjs
MediumSecret Patterndist/chunk-22F3PGAC.cjs
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/chunk-PQB6IXXA.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @zapier/zapier-sdk@0.112.0.
See all versions of @zapier/zapier-sdk for other recorded verdicts.
- Review the evidence and your use of @zapier/zapier-sdk@0.112.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.