registry / @zapier/zapier-sdk / 0.87.0
@zapier/zapier-sdk@0.87.0
Complete Zapier SDK - combines all Zapier SDK packages
AI Security Review
scanned 3mo ago · by lpm-firewall-aiStatic inspection shows a normal Zapier SDK with no lifecycle hooks or concrete malicious chain. Scanner signals correspond to documented credential handling and API functionality.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer invokes SDK authentication, API, approval, or manifest-update methods.
Impact
No unconsented mutation, payload execution, or exfiltration established.
Mechanism
Authorized Zapier API client with optional telemetry and manifest persistence.
AI rationale
Static inspection shows a normal Zapier SDK with no lifecycle hooks or concrete malicious chain. Scanner signals correspond to documented credential handling and API functionality.
Evidence
package.jsondist/chunk-XUT7EPI7.mjsREADME.md.zapierrc
Network endpoints2
zapier.comsdkapi.zapier.com
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall hooks.
- dist/chunk-XUT7EPI7.mjs performs SDK API calls only after runtime method use.
- Credential env values are used for Zapier authentication, not harvested or sent to unrelated hosts.
- child_process is limited to opening an http(s) approval URL.
- Manifest writes target .zapierrc through an explicit update method.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/chunk-XUT7EPI7.mjsView file
10526patternName = generic_password
severity = medium
line = 10526
matchedText = password... */,
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/chunk-XUT7EPI7.mjsView on unpkg · L10526dist/index-CBvczsOD.d.tsView file
4702patternName = generic_password
severity = medium
line = 4702
matchedText = password...rd";
Medium
Secret Pattern
Hardcoded password in dist/index-CBvczsOD.d.ts
dist/index-CBvczsOD.d.tsView on unpkg · L47024909patternName = generic_password
severity = medium
line = 4909
matchedText = password...rd";
Medium
Secret Pattern
Hardcoded password in dist/index-CBvczsOD.d.ts
dist/index-CBvczsOD.d.tsView on unpkg · L4909Findings
8 Medium5 Low
MediumSecret Patterndist/chunk-XUT7EPI7.mjs
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndist/index-CBvczsOD.d.ts
MediumSecret Patterndist/index-CBvczsOD.d.ts
MediumSecret Patterndist/chunk-275CXIIT.cjs
MediumSecret Patterndist/index-CBvczsOD.d.mts
MediumSecret Patterndist/index-CBvczsOD.d.mts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @zapier/zapier-sdk@0.87.0.
See all versions of @zapier/zapier-sdk for other recorded verdicts.
- Review the evidence and your use of @zapier/zapier-sdk@0.87.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.