registry / Credential exfiltration / @zuplo/cli / 7.12.2

@zuplo/cli@7.12.2

<p align="center"> <a href="https://zuplo.com"> <img src="https://portal.zuplo.com/zuplo.svg" height="96"> <h3 align="center">Zuplo</h3> </a> </p> <p align="center">Zuplo's API Gateway helps small and large teams get APIs to production that ar

AI Security Review

scanned 19d ago · by lpm-firewall-ai

This is a conditional credential-exposure risk in an explicit user-run command, not evidence of covert theft: the default endpoint is Zuplo’s developer service, while an operator-configured endpoint is not bound to that service. Warn because the endpoint override can redirect an existing session token without a destination allowlist.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running `zup info` or `zup project info` for a linked project while authenticated and using a custom `ZUPLO_DEVELOPER_API_ENDPOINT`.

Impact

The configured recipient may receive the existing Zuplo access token.

Mechanism

The handler builds the request URL from the endpoint setting and attaches the authenticated token as a bearer credential without restricting the endpoint host.

AI rationale

Evidence

dist/common/settings.jsdist/login/tokens.jsdist/common/middleware/authentication.jsdist/project/info/handler.jsdist/cmds/info.jsdist/cmds/project/info.js

Network endpoints1

dev.zuplo.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The `zup` executable loads the CLI, which registers the `info` command.
Authentication uses a supplied API key or reads an existing access token from local auth state.
The `info` commands reach the project handler, which sends the token as a bearer credential in a request to the configured API endpoint.
The endpoint defaults to Zuplo’s developer service but can be replaced through an environment variable; the source does not restrict that value to Zuplo hosts.

Evidence against

The configured default recipient is Zuplo’s developer API, consistent with the CLI’s project-information request.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 197 file(s), 457 KB of source, external domains: api.example.com, api.prod.example.com, app.posthog.com, cdn.jsdelivr.net, cdn.zuplo.com, dev.zuplo.com, github.com, learn.microsoft.com, my-api-dev-123abc.zuplo.app, my-api.zuplo.dev, portal.zuplo.com, registry.npmjs.org, your-api-123abc.zuplo.app, zuplo.com

Source & flagged code

20 flagged

dist/source/ai-gateway/files.jsView file

1import { execFile } from "node:child_process"; L2: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/source/ai-gateway/files.jsView on unpkg · L1

dist/source/migrate/dev-portal/handler.jsView file

20}; L21: const execAsync = promisify(exec); L22: export const migrateDevPortal = async (args) => {

High

Shell

Package source references shell execution.

dist/source/migrate/dev-portal/handler.jsView on unpkg · L20

node_modules/pino/benchmarks/utils/wrap-log-level.jsView file

Findings

2 Critical11 High8 Medium7 Low

CriticalCredential Exfiltrationnode_modules/@zuplo/core/zeno.js

CriticalTrojan Source Unicodenode_modules/@zuplo/editor/dist/client/static/js/codemirror-6ITIKbGP.js

HighChild Processdist/source/ai-gateway/files.js

HighShelldist/source/migrate/dev-portal/handler.js

HighSame File Env Network Executionnode_modules/@zuplo/core/customer.cli.minified.js

HighCredential Redirect Persistencenode_modules/@zuplo/core/customer.cli.minified.js

HighCommand Output Exfiltrationnode_modules/@zuplo/core/customer.cli.minified.js

HighCloud Metadata Accessnode_modules/@zuplo/runtime/out/esm/chunk-M62BWITW.js

HighCopied Package Dependency Bridgedist/common/analytics/lib.js

High

Affected versions and remediation

This report applies to @zuplo/cli@7.12.2.

See all versions of @zuplo/cli for other recorded verdicts.

Review the evidence and your use of @zuplo/cli@7.12.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 21:45:41.688Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Credential exfiltration / @zuplo/cli / 7.12.2

@zuplo/cli@7.12.2

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running `zup info` or `zup project info` for a linked project while authenticated and using a custom `ZUPLO_DEVELOPER_API_ENDPOINT`.

Impact

The configured recipient may receive the existing Zuplo access token.

Mechanism

The handler builds the request URL from the endpoint setting and attaches the authenticated token as a bearer credential without restricting the endpoint host.

AI rationale

Evidence

dist/common/settings.jsdist/login/tokens.jsdist/common/middleware/authentication.jsdist/project/info/handler.jsdist/cmds/info.jsdist/cmds/project/info.js

Network endpoints1

dev.zuplo.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The `zup` executable loads the CLI, which registers the `info` command.
Authentication uses a supplied API key or reads an existing access token from local auth state.
The `info` commands reach the project handler, which sends the token as a bearer credential in a request to the configured API endpoint.
The endpoint defaults to Zuplo’s developer service but can be replaced through an environment variable; the source does not restrict that value to Zuplo hosts.

Evidence against

The configured default recipient is Zuplo’s developer API, consistent with the CLI’s project-information request.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

Source & flagged code

20 flagged

dist/source/ai-gateway/files.jsView file

1import { execFile } from "node:child_process"; L2: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/source/ai-gateway/files.jsView on unpkg · L1

dist/source/migrate/dev-portal/handler.jsView file

20}; L21: const execAsync = promisify(exec); L22: export const migrateDevPortal = async (args) => {

High

Shell

Package source references shell execution.

dist/source/migrate/dev-portal/handler.jsView on unpkg · L20

node_modules/pino/benchmarks/utils/wrap-log-level.jsView file

Findings

2 Critical11 High8 Medium7 Low

CriticalCredential Exfiltrationnode_modules/@zuplo/core/zeno.js

CriticalTrojan Source Unicodenode_modules/@zuplo/editor/dist/client/static/js/codemirror-6ITIKbGP.js

HighChild Processdist/source/ai-gateway/files.js

HighShelldist/source/migrate/dev-portal/handler.js

HighSame File Env Network Executionnode_modules/@zuplo/core/customer.cli.minified.js

HighCredential Redirect Persistencenode_modules/@zuplo/core/customer.cli.minified.js

HighCommand Output Exfiltrationnode_modules/@zuplo/core/customer.cli.minified.js

HighCloud Metadata Accessnode_modules/@zuplo/runtime/out/esm/chunk-M62BWITW.js

HighCopied Package Dependency Bridgedist/common/analytics/lib.js

High

Affected versions and remediation

This report applies to @zuplo/cli@7.12.2.

See all versions of @zuplo/cli for other recorded verdicts.

Review the evidence and your use of @zuplo/cli@7.12.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 21:45:41.688Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.