registry / @zapier/zapier-sdk / 0.119.3
@zapier/zapier-sdk@0.119.3
Complete Zapier SDK - combines all Zapier SDK packages
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe scanner’s command execution and network signals are explained by browser-based approval handling and normal Zapier API requests. The manifest has no install lifecycle hooks, and the browser launch is conditional rather than automatic.
Static reason
One or more suspicious static signals were detected.
Trigger
SDK API calls; browser opening only when approval handling is enabled by the caller or configuration.
Impact
Expected SDK API and approval behavior; no automatic collection or unrelated command execution was found.
Mechanism
The SDK sends API requests to Zapier services and may launch the system browser for an approval URL after checking its origin.
AI rationale
The scanner’s command execution and network signals are explained by browser-based approval handling and normal Zapier API requests. The manifest has no install lifecycle hooks, and the browser launch is conditional rather than automatic.
Network endpoints3
zapier.comsdkapi.zapier.comapi.zapier.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no install, preinstall, or postinstall script; its scripts are build and development tasks.
- The child_process use launches the platform browser opener with an HTTP(S) URL; it does not capture command output.
- Opening approval URLs is conditional on an explicit option or setting, which defaults to false.
- Approval URLs are checked against expected Zapier origins before use, and the default API base URL is Zapier.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/chunk-WVJTLSO7.mjsView file
11// src/constants.ts
L12: var ZAPIER_BASE_URL = globalThis.process?.env?.ZAPIER_BASE_URL || "https://zapier.com";
L13: function getZapierSdkService() {
...
L69: function getZapierDefaultApprovalMode() {
L70: const isInteractive = !!globalThis.process?.stdin?.isTTY && !!globalThis.process?.stdout?.isTTY;
L71: return isInteractive ? "poll" : "throw";
...
L566: }
L567: const base64UrlPattern = /^[A-Za-z0-9_-]+$/;
L568: return parts.every((part) => part.length > 0 && base64UrlPattern.test(part));
...
L768: headers: censorHeaders(options2?.headers),
L769: body: options2?.body && typeof options2.body === "string" ? (() => {
L770: try {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-WVJTLSO7.mjsView on unpkg · L118311patternName = generic_password
severity = medium
line = 8311
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-WVJTLSO7.mjsView on unpkg · L8311dist/chunk-GPR33J4Q.cjsView file
Findings
1 High6 Medium5 Low
HighCommand Output Exfiltrationdist/chunk-WVJTLSO7.mjs
MediumSecret Patterndist/chunk-WVJTLSO7.mjs
MediumDynamic Requiredist/chunk-GPR33J4Q.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/chunk-SR5UBRRB.cjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @zapier/zapier-sdk@0.119.3.
See all versions of @zapier/zapier-sdk for other recorded verdicts.
- Review the evidence and your use of @zapier/zapier-sdk@0.119.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.