registry / @zuplo/cli / 7.8.1
@zuplo/cli@7.8.1
⚠ Under review<p align="center"> <a href="https://zuplo.com"> <img src="https://portal.zuplo.com/zuplo.svg" height="96"> <h3 align="center">Zuplo</h3> </a> </p> <p align="center">Zuplo's API Gateway helps small and large teams get APIs to production that ar
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe inspected code does not establish malicious behavior. Manual review is required solely because the mandatory clean citation coverage requires nine distinct paths while the schema permits at most eight citations.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No malicious trigger was identified; the inspected migration behavior requires an explicit CLI command.
Impact
No confirmed malicious impact was established.
Mechanism
No confirmed attack mechanism was identified. The CLI has opt-out analytics and an explicit migration command that writes project files.
AI rationale
The inspected code does not establish malicious behavior. Manual review is required solely because the mandatory clean citation coverage requires nine distinct paths while the schema permits at most eight citations.
Decision evidence
public snapshotAI called this Manual Review at 91.0% confidence as Unknown with high false-positive risk.
AI review observations
- The manifest exposes a CLI binary and contains no install lifecycle hook.
- The dev-portal migration runs only after the explicit source-migrate command.
- Analytics is disabled when ZUPLO_DO_NOT_TRACK is set.
- The machine identifier is hashed before use.
Evidence against
- The CLI can send analytics and uses a hashed machine identifier when tracking is enabled.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
21 flaggeddist/source/migrate/dev-portal/handler.jsView file
1import { exec } from "node:child_process";
L2: import { mkdir, readFile, rename, stat, unlink, writeFile, } from "node:fs/promises";
High
Child Process
Package source references child process execution.
dist/source/migrate/dev-portal/handler.jsView on unpkg · L120};
L21: const execAsync = promisify(exec);
L22: export const migrateDevPortal = async (args) => {
High
Shell
Package source references shell execution.
dist/source/migrate/dev-portal/handler.jsView on unpkg · L20node_modules/pino/benchmarks/utils/wrap-log-level.jsView file
6const code = readFileSync(
L7: join(__dirname, '..', '..', 'node_modules', 'loglevel', 'lib', 'loglevel.js')
L8: )
...
L50: if (require.main === module) {
L51: const loglevel = build(process.stdout)
L52: loglevel.info('hello')
Findings
3 Critical11 High8 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationnode_modules/@zuplo/runtime/out/esm/chunk-UZ6DQL7L.js
CriticalCredential Exfiltrationnode_modules/@zuplo/core/zeno.js
CriticalTrojan Source Unicodenode_modules/@zuplo/editor/dist/client/static/js/codemirror-6ITIKbGP.js
HighChild Processdist/source/migrate/dev-portal/handler.js
HighShelldist/source/migrate/dev-portal/handler.js
HighSame File Env Network Executionnode_modules/@zuplo/core/customer.cli.minified.js
HighCredential Redirect Persistencenode_modules/@zuplo/core/customer.cli.minified.js
HighCommand Output Exfiltrationnode_modules/@zuplo/core/customer.cli.minified.js
HighCloud Metadata Accessnode_modules/@zuplo/runtime/out/esm/chunk-UZ6DQL7L.js
Affected versions and remediation
This report applies to @zuplo/cli@7.8.1.
See all versions of @zuplo/cli for other recorded verdicts.
- Review the evidence and your use of @zuplo/cli@7.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.