registry  /  cloudflare  /  7.0.0

cloudflare@7.0.0

The official TypeScript library for the Cloudflare API

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Runtime network behavior is an official Cloudflare API client; the CLI migration command is explicit user action.

Static reason
One or more suspicious static signals were detected.
Trigger
Importing the library constructs exports; network calls occur when user code calls API methods, and npx runs only via `cloudflare migrate`.
Impact
Uses provided Cloudflare credentials for intended Cloudflare API requests; no unconsented install-time behavior found.
Mechanism
Generated Cloudflare API SDK with optional explicit migration CLI
Rationale
Static inspection shows a generated official Cloudflare SDK with package-aligned environment credential handling and Cloudflare API fetches. The scanner hits are explained by normal SDK behavior, documentation examples, and an explicit migration CLI rather than hidden install/import-time attack behavior.
Evidence
package.jsonindex.jsclient.jsbin/cliinternal/utils/env.jsresources/custom-hostnames/certificate-pack/certificates.mjs
Network endpoints2
api.cloudflare.com/client/v4github.com/stainless-api/migrate-ts/releases/download/0.0.2/stainless-api-migrate-0.0.2-6.tgz

Decision evidence

public snapshot
AI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for block
  • bin/cli user-invoked migrate subcommand runs npx against a Stainless GitHub release tarball.
  • client.js reads Cloudflare env credentials and sends authenticated requests when API methods are called.
Evidence against
  • package.json has no preinstall/install/postinstall lifecycle hooks.
  • index.js only re-exports generated client, uploads, promise, pagination, and error modules.
  • client.js uses fetch to default https://api.cloudflare.com/client/v4 and builds Cloudflare auth headers; behavior is package-aligned.
  • resources/custom-hostnames/certificate-pack/certificates.mjs contains example PEM text in docs, not an embedded usable secret or execution path.
  • bin/cli child_process use is explicit CLI migration command, not import-time or install-time execution.
  • No evidence of credential harvesting, persistence, destructive file writes, or AI-agent control-surface mutation.
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 5,017 file(s), 17.6 MB of source, external domains: api.cloudflare.com

Source & flagged code

27 flagged · loading source
resources/custom-hostnames/certificate-pack/certificates.mjsView file
26patternName = private_key_rsa severity = critical line = 26 matchedText = * ...\n',
Critical
Critical Secret

Package contains a critical-looking secret pattern.

resources/custom-hostnames/certificate-pack/certificates.mjsView on unpkg · L26
26patternName = private_key_rsa severity = critical line = 26 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/custom-hostnames/certificate-pack/certificates.mjs

resources/custom-hostnames/certificate-pack/certificates.mjsView on unpkg · L26
client.jsView file
4exports.Cloudflare = exports.BaseCloudflare = void 0; L5: const tslib_1 = require("./internal/tslib.js"); L6: const uuid_1 = require("./internal/utils/uuid.js");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

client.jsView on unpkg · L4
resources/custom-hostnames/certificate-pack/certificates.jsView file
29patternName = private_key_rsa severity = critical line = 29 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/custom-hostnames/certificate-pack/certificates.js

resources/custom-hostnames/certificate-pack/certificates.jsView on unpkg · L29
resources/custom-hostnames/certificate-pack/certificates.d.mtsView file
28patternName = private_key_rsa severity = critical line = 28 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/custom-hostnames/certificate-pack/certificates.d.mts

resources/custom-hostnames/certificate-pack/certificates.d.mtsView on unpkg · L28
resources/custom-hostnames/certificate-pack/certificates.d.tsView file
28patternName = private_key_rsa severity = critical line = 28 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/custom-hostnames/certificate-pack/certificates.d.ts

resources/custom-hostnames/certificate-pack/certificates.d.tsView on unpkg · L28
resources/origin-tls-client-auth/zone-certificates.d.tsView file
22patternName = private_key_rsa severity = critical line = 22 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/origin-tls-client-auth/zone-certificates.d.ts

resources/origin-tls-client-auth/zone-certificates.d.tsView on unpkg · L22
resources/origin-tls-client-auth/hostname-certificates.d.tsView file
20patternName = private_key_rsa severity = critical line = 20 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/origin-tls-client-auth/hostname-certificates.d.ts

resources/origin-tls-client-auth/hostname-certificates.d.tsView on unpkg · L20
resources/origin-tls-client-auth/hostname-certificates.mjsView file
20patternName = private_key_rsa severity = critical line = 20 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/origin-tls-client-auth/hostname-certificates.mjs

resources/origin-tls-client-auth/hostname-certificates.mjsView on unpkg · L20
resources/origin-tls-client-auth/zone-certificates.mjsView file
22patternName = private_key_rsa severity = critical line = 22 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/origin-tls-client-auth/zone-certificates.mjs

resources/origin-tls-client-auth/zone-certificates.mjsView on unpkg · L22
resources/origin-tls-client-auth/hostname-certificates.d.mtsView file
20patternName = private_key_rsa severity = critical line = 20 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/origin-tls-client-auth/hostname-certificates.d.mts

resources/origin-tls-client-auth/hostname-certificates.d.mtsView on unpkg · L20
resources/origin-tls-client-auth/zone-certificates.jsView file
25patternName = private_key_rsa severity = critical line = 25 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/origin-tls-client-auth/zone-certificates.js

resources/origin-tls-client-auth/zone-certificates.jsView on unpkg · L25
resources/origin-tls-client-auth/hostname-certificates.jsView file
23patternName = private_key_rsa severity = critical line = 23 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/origin-tls-client-auth/hostname-certificates.js

resources/origin-tls-client-auth/hostname-certificates.jsView on unpkg · L23
resources/origin-tls-client-auth/zone-certificates.d.mtsView file
22patternName = private_key_rsa severity = critical line = 22 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in resources/origin-tls-client-auth/zone-certificates.d.mts

resources/origin-tls-client-auth/zone-certificates.d.mtsView on unpkg · L22
resources/hyperdrive/configs.d.tsView file
20patternName = generic_password severity = medium line = 20 matchedText = * pa...rd',
Medium
Secret Pattern

Hardcoded password in resources/hyperdrive/configs.d.ts

resources/hyperdrive/configs.d.tsView on unpkg · L20
42patternName = generic_password severity = medium line = 42 matchedText = * ...rd',
Medium
Secret Pattern

Hardcoded password in resources/hyperdrive/configs.d.ts

resources/hyperdrive/configs.d.tsView on unpkg · L42
resources/hyperdrive/configs.jsView file
21patternName = generic_password severity = medium line = 21 matchedText = * pa...rd',
Medium
Secret Pattern

Hardcoded password in resources/hyperdrive/configs.js

resources/hyperdrive/configs.jsView on unpkg · L21
49patternName = generic_password severity = medium line = 49 matchedText = * ...rd',
Medium
Secret Pattern

Hardcoded password in resources/hyperdrive/configs.js

resources/hyperdrive/configs.jsView on unpkg · L49
resources/hyperdrive/configs.mjsView file
18patternName = generic_password severity = medium line = 18 matchedText = * pa...rd',
Medium
Secret Pattern

Hardcoded password in resources/hyperdrive/configs.mjs

resources/hyperdrive/configs.mjsView on unpkg · L18
46patternName = generic_password severity = medium line = 46 matchedText = * ...rd',
Medium
Secret Pattern

Hardcoded password in resources/hyperdrive/configs.mjs

resources/hyperdrive/configs.mjsView on unpkg · L46
resources/hyperdrive/configs.d.mtsView file
20patternName = generic_password severity = medium line = 20 matchedText = * pa...rd',
Medium
Secret Pattern

Hardcoded password in resources/hyperdrive/configs.d.mts

resources/hyperdrive/configs.d.mtsView on unpkg · L20
42patternName = generic_password severity = medium line = 42 matchedText = * ...rd',
Medium
Secret Pattern

Hardcoded password in resources/hyperdrive/configs.d.mts

resources/hyperdrive/configs.d.mtsView on unpkg · L42
src/resources/custom-hostnames/certificate-pack/certificates.tsView file
34patternName = private_key_rsa severity = critical line = 34 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in src/resources/custom-hostnames/certificate-pack/certificates.ts

src/resources/custom-hostnames/certificate-pack/certificates.tsView on unpkg · L34
src/resources/origin-tls-client-auth/zone-certificates.tsView file
30patternName = private_key_rsa severity = critical line = 30 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in src/resources/origin-tls-client-auth/zone-certificates.ts

src/resources/origin-tls-client-auth/zone-certificates.tsView on unpkg · L30
src/resources/origin-tls-client-auth/hostname-certificates.tsView file
28patternName = private_key_rsa severity = critical line = 28 matchedText = * ...\n',
Critical
Secret Pattern

RSA private key in src/resources/origin-tls-client-auth/hostname-certificates.ts

src/resources/origin-tls-client-auth/hostname-certificates.tsView on unpkg · L28
src/resources/hyperdrive/configs.tsView file
28patternName = generic_password severity = medium line = 28 matchedText = * pa...rd',
Medium
Secret Pattern

Hardcoded password in src/resources/hyperdrive/configs.ts

src/resources/hyperdrive/configs.tsView on unpkg · L28
59patternName = generic_password severity = medium line = 59 matchedText = * ...rd',
Medium
Secret Pattern

Hardcoded password in src/resources/hyperdrive/configs.ts

src/resources/hyperdrive/configs.tsView on unpkg · L59

Findings

16 Critical14 Medium3 Low
CriticalCritical Secretresources/custom-hostnames/certificate-pack/certificates.mjs
CriticalSecret Patternresources/custom-hostnames/certificate-pack/certificates.mjs
CriticalSecret Patternresources/custom-hostnames/certificate-pack/certificates.js
CriticalSecret Patternresources/custom-hostnames/certificate-pack/certificates.d.mts
CriticalSecret Patternresources/custom-hostnames/certificate-pack/certificates.d.ts
CriticalSecret Patternresources/origin-tls-client-auth/zone-certificates.d.ts
CriticalSecret Patternresources/origin-tls-client-auth/hostname-certificates.d.ts
CriticalSecret Patternresources/origin-tls-client-auth/hostname-certificates.mjs
CriticalSecret Patternresources/origin-tls-client-auth/zone-certificates.mjs
CriticalSecret Patternresources/origin-tls-client-auth/hostname-certificates.d.mts
CriticalSecret Patternresources/origin-tls-client-auth/zone-certificates.js
CriticalSecret Patternresources/origin-tls-client-auth/hostname-certificates.js
CriticalSecret Patternresources/origin-tls-client-auth/zone-certificates.d.mts
CriticalSecret Patternsrc/resources/custom-hostnames/certificate-pack/certificates.ts
CriticalSecret Patternsrc/resources/origin-tls-client-auth/zone-certificates.ts
CriticalSecret Patternsrc/resources/origin-tls-client-auth/hostname-certificates.ts
MediumDynamic Requireclient.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternresources/hyperdrive/configs.d.ts
MediumSecret Patternresources/hyperdrive/configs.d.ts
MediumSecret Patternresources/hyperdrive/configs.js
MediumSecret Patternresources/hyperdrive/configs.js
MediumSecret Patternresources/hyperdrive/configs.mjs
MediumSecret Patternresources/hyperdrive/configs.mjs
MediumSecret Patternresources/hyperdrive/configs.d.mts
MediumSecret Patternresources/hyperdrive/configs.d.mts
MediumSecret Patternsrc/resources/hyperdrive/configs.ts
MediumSecret Patternsrc/resources/hyperdrive/configs.ts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings