@zuplo/cli@7.11.4
<p align="center"> <a href="https://zuplo.com"> <img src="https://portal.zuplo.com/zuplo.svg" height="96"> <h3 align="center">Zuplo</h3> </a> </p> <p align="center">Zuplo's API Gateway helps small and large teams get APIs to production that ar
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe project-info flow sends a saved or supplied Zuplo token to a configurable endpoint without a destination allowlist. The default is package-aligned, so this warrants a warning for conditional credential exposure rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Invoking `zup info` or `zup project info` for a linked project.
Impact
If configured to an unintended host, that host receives the bearer token.
Mechanism
The command authenticates, then the handler sends argv.authToken in a bearer Authorization header to the endpoint selected by ZUPLO_DEVELOPER_API_ENDPOINT or its default.
AI rationale
The project-info flow sends a saved or supplied Zuplo token to a configurable endpoint without a destination allowlist. The default is package-aligned, so this warrants a warning for conditional credential exposure rather than a block.
Evidence
dist/common/settings.jsdist/project/info/handler.jsdist/cmds/info.jsdist/cmds/project/info.jsdist/common/middleware/authentication.js
Network endpoints1
dev.zuplo.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package is a Zuplo command line tool, and its default developer API endpoint is https://dev.zuplo.com.
- The project information handler sends argv.authToken as a bearer token to the configured endpoint.
- Both info commands invoke the project information handler.
- For linked projects, the project info command runs authentication middleware before its handler; that middleware places an API key or saved login token in argv.authToken.
- The endpoint can be overridden through ZUPLO_DEVELOPER_API_ENDPOINT, and the inspected request has no destination allowlist.
Evidence against
- The default recipient is Zuplo's developer API, and the request is part of the project information command. The exposure depends on configuring the endpoint to an unintended host.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
20 flaggeddist/source/ai-gateway/files.jsView file
1import { execFile } from "node:child_process";
L2: import { randomUUID } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/source/ai-gateway/files.jsView on unpkg · L1dist/source/migrate/dev-portal/handler.jsView file
20};
L21: const execAsync = promisify(exec);
L22: export const migrateDevPortal = async (args) => {
High
Shell
Package source references shell execution.
dist/source/migrate/dev-portal/handler.jsView on unpkg · L20node_modules/pino/benchmarks/utils/wrap-log-level.jsView file
Findings
2 Critical11 High8 Medium7 Low
CriticalCredential Exfiltrationnode_modules/@zuplo/core/zeno.js
CriticalTrojan Source Unicodenode_modules/@zuplo/editor/dist/client/static/js/codemirror-6ITIKbGP.js
HighChild Processdist/source/ai-gateway/files.js
HighShelldist/source/migrate/dev-portal/handler.js
HighSame File Env Network Executionnode_modules/@zuplo/core/customer.cli.minified.js
HighCredential Redirect Persistencenode_modules/@zuplo/core/customer.cli.minified.js
HighCommand Output Exfiltrationnode_modules/@zuplo/core/customer.cli.minified.js
HighCloud Metadata Accessnode_modules/@zuplo/runtime/out/esm/chunk-3RVZUQKN.js
HighCopied Package Dependency Bridgedist/common/analytics/lib.js
High
Affected versions and remediation
This report applies to @zuplo/cli@7.11.4.
See all versions of @zuplo/cli for other recorded verdicts.
- Review the evidence and your use of @zuplo/cli@7.11.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.