@zapier/zapier-sdk@0.118.0
Complete Zapier SDK - combines all Zapier SDK packages
AI Security Review
scanned 6d ago · by lpm-firewall-aiThis is suspicious undisclosed runtime telemetry: SDK creation enables reporting by default, and error events can carry error text and stack traces. The package provides opt-outs, has no install hook, and the reviewed traffic is directed to Zapier’s tracking endpoint, so the evidence does not support a malicious verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Creating the SDK emitter starts lifecycle reporting; method calls and process errors can produce further events.
Impact
Usage, platform, and runtime context are reported; error events may include user-specific error text or local paths in stack traces.
Mechanism
The SDK posts event payloads over HTTP. Disabling is available through `eventEmission.enabled` or `ZAPIER_SDK_TELEMETRY_TRANSPORT=disabled`.
AI rationale
This is suspicious undisclosed runtime telemetry: SDK creation enables reporting by default, and error events can carry error text and stack traces. The package provides opt-outs, has no install hook, and the reviewed traffic is directed to Zapier’s tracking endpoint, so the evidence does not support a malicious verdict.
Evidence
dist/chunk-DH2I3KFA.mjs
Network endpoints1
zapier.com (default tracking base; /api/v4/tracking/event/)
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Event reporting is enabled by default and sends a startup event when the SDK emitter is created.
- The default HTTP tracking endpoint uses `/api/v4/tracking/event/` on the tracking base; environment and SDK options can override it.
- Lifecycle events include OS and platform details, runtime environment, CI status, and resource usage.
- Uncaught exception and unhandled rejection events include error messages and stack traces.
- A hook emits method-call events after SDK methods run.
Evidence against
- The manifest has no install lifecycle hooks; its scripts are build, clean, development, typecheck, and test commands.
- The command execution flagged by the scanner belongs to an HTTP(S)-only URL opener used in approval flows; auto-mode browser opening is off by default.
Behavioral surface
DynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
5 flaggeddist/chunk-DH2I3KFA.mjsView file
11// src/constants.ts
L12: var ZAPIER_BASE_URL = globalThis.process?.env?.ZAPIER_BASE_URL || "https://zapier.com";
L13: function getZapierSdkService() {
...
L69: function getZapierDefaultApprovalMode() {
L70: const isInteractive = !!globalThis.process?.stdin?.isTTY && !!globalThis.process?.stdout?.isTTY;
L71: return isInteractive ? "poll" : "throw";
...
L566: }
L567: const base64UrlPattern = /^[A-Za-z0-9_-]+$/;
L568: return parts.every((part) => part.length > 0 && base64UrlPattern.test(part));
...
L768: headers: censorHeaders(options2?.headers),
L769: body: options2?.body && typeof options2.body === "string" ? (() => {
L770: try {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-DH2I3KFA.mjsView on unpkg · L118293patternName = generic_password
severity = medium
line = 8293
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-DH2I3KFA.mjsView on unpkg · L8293dist/beta.cjsView file
Findings
1 Critical1 High6 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/chunk-B3ZGHT7T.cjs
HighCommand Output Exfiltrationdist/chunk-DH2I3KFA.mjs
MediumSecret Patterndist/chunk-DH2I3KFA.mjs
MediumDynamic Requiredist/beta.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/chunk-B3ZGHT7T.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @zapier/zapier-sdk@0.118.0.
See all versions of @zapier/zapier-sdk for other recorded verdicts.
- Review the evidence and your use of @zapier/zapier-sdk@0.118.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.