registry / cdk-insights / 1.61.7
cdk-insights@1.61.7
AWS CDK security and cost analysis CLI. Free static scans via npm - no account needed. Sign up free to add AI-powered insights.
AI Security Review
scanned 16d ago · by lpm-firewall-aiSource inspection found the scanner’s credential finding corresponds to the CLI’s license authentication flow, which defaults to the vendor API and sends the credential supplied to that flow. The prepare hook performs Husky setup and a build; no concrete malicious behavior was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Invoking the CLI authentication flow.
Impact
No confirmed credential theft, malicious persistence, or other attack impact was established.
Mechanism
The flow posts its supplied license key and project value to the selected login endpoint; the default endpoint is package-aligned.
AI rationale
Source inspection found the scanner’s credential finding corresponds to the CLI’s license authentication flow, which defaults to the vendor API and sends the credential supplied to that flow. The prepare hook performs Husky setup and a build; no concrete malicious behavior was established.
Network endpoints1
api.cdkinsights.dev
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The prepare hook installs Husky and builds the package.
- The CLI defaults its API endpoint to the package vendor’s service.
- Authentication sends a license key and project value to the selected login endpoint.
- The import entrypoint exports CDK analysis aspects, plugins, and utilities.
Evidence against
- The CLI allows an environment variable to override its API endpoint, but the inspected authentication flow sends the license key supplied to that flow; no unrelated credential forwarding or persistence was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
2550${M.info("\u{1F4CB} Falling back to static analysis only")}`),e.log(M.comment("\u{1F4A1} Upgrade to Pro for unlimited AI analysis: https://cdkinsights.dev/pricing")),e.log(`${M.com...
L2551: `))}}},Z=G1();var TC=e=>e&&(e.Name||e.ResourceName||e.FunctionName)||"Unnamed";var Fp=null,PC=e=>{Fp=e};var _p=()=>{if(Fp&&!process.env.CI)try{Fp.saveToDisk(),it.info("\u{1F4BE} Ca...
L2552: `).map(t=>t.trim()).filter(Boolean).join(`
High
2546${M.primary.bold("\u{1F381} CDK Insights Trial")}`),e.log(M.comment("\u2500".repeat(50))),e.log(`${je} Status: ${ke.bold(oe)}`),ae&&e.log(`\u{1F4E6} Plan: ${M.info.bold(ae.charAt(0...
L2547: ${M.comment("\u{1F4A1} Next Steps:")}`),De?(e.log(M.error(" \u274C Trial expired - upgrade to continue")),e.log(M.comment(" \u{1F517} https://cdkinsights.dev/pricing"))):me>=90...
L2548: `)},displayQuotaWarning:_=>{let{currentResourcesAnalyzed:B,maxResources:ne,requestedResources:ge,isTrial:De}=_;if(!De)return;B+ge>ne&&(e.log(`
...
L2550: ${M.info("\u{1F4CB} Falling back to static analysis only")}`),e.log(M.comment("\u{1F4A1} Upgrade to Pro for unlimited AI analysis: https://cdkinsights.dev/pricing")),e.log(`${M.com...
L2551: `))}}},Z=G1();var TC=e=>e&&(e.Name||e.ResourceName||e.FunctionName
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L2546Findings
2 Critical10 High4 Medium6 Low
CriticalCredential Exfiltrationdist/entry.js
CriticalTrigger Reachable Dangerous Capabilitydist/entry.js
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/entry.js
HighCommand Output Exfiltrationdist/entry.js
HighSandbox Evasion Gated Capabilitydist/entry.js
HighCloud Metadata Accessdist/entry.js
HighTrigger Reachable Credential Exfiltrationdist/entry.js
HighTrigger Reachable Command Output Exfiltrationdist/entry.js
HighSemantic Analysis Limiteddist/entry.js
Affected versions and remediation
This report applies to cdk-insights@1.61.7.
See all versions of cdk-insights for other recorded verdicts.
- Review the evidence and your use of cdk-insights@1.61.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.