AI Security Review
scanned 2h ago · by lpm-firewall-aiNo confirmed malicious attack surface is established. Runtime network behavior is an official Cloudflare API client; the CLI migration command is explicit user action.
Decision evidence
public snapshot- bin/cli user-invoked migrate subcommand runs npx against a Stainless GitHub release tarball.
- client.js reads Cloudflare env credentials and sends authenticated requests when API methods are called.
- package.json has no preinstall/install/postinstall lifecycle hooks.
- index.js only re-exports generated client, uploads, promise, pagination, and error modules.
- client.js uses fetch to default https://api.cloudflare.com/client/v4 and builds Cloudflare auth headers; behavior is package-aligned.
- resources/custom-hostnames/certificate-pack/certificates.mjs contains example PEM text in docs, not an embedded usable secret or execution path.
- bin/cli child_process use is explicit CLI migration command, not import-time or install-time execution.
- No evidence of credential harvesting, persistence, destructive file writes, or AI-agent control-surface mutation.
Source & flagged code
27 flagged · loading sourcePackage contains a critical-looking secret pattern.
resources/custom-hostnames/certificate-pack/certificates.mjsView on unpkg · L26RSA private key in resources/custom-hostnames/certificate-pack/certificates.mjs
resources/custom-hostnames/certificate-pack/certificates.mjsView on unpkg · L26Package source references dynamic require/import behavior.
client.jsView on unpkg · L4RSA private key in resources/custom-hostnames/certificate-pack/certificates.js
resources/custom-hostnames/certificate-pack/certificates.jsView on unpkg · L29RSA private key in resources/custom-hostnames/certificate-pack/certificates.d.mts
resources/custom-hostnames/certificate-pack/certificates.d.mtsView on unpkg · L28RSA private key in resources/custom-hostnames/certificate-pack/certificates.d.ts
resources/custom-hostnames/certificate-pack/certificates.d.tsView on unpkg · L28RSA private key in resources/origin-tls-client-auth/zone-certificates.d.ts
resources/origin-tls-client-auth/zone-certificates.d.tsView on unpkg · L22RSA private key in resources/origin-tls-client-auth/hostname-certificates.d.ts
resources/origin-tls-client-auth/hostname-certificates.d.tsView on unpkg · L20RSA private key in resources/origin-tls-client-auth/hostname-certificates.mjs
resources/origin-tls-client-auth/hostname-certificates.mjsView on unpkg · L20RSA private key in resources/origin-tls-client-auth/zone-certificates.mjs
resources/origin-tls-client-auth/zone-certificates.mjsView on unpkg · L22RSA private key in resources/origin-tls-client-auth/hostname-certificates.d.mts
resources/origin-tls-client-auth/hostname-certificates.d.mtsView on unpkg · L20RSA private key in resources/origin-tls-client-auth/zone-certificates.js
resources/origin-tls-client-auth/zone-certificates.jsView on unpkg · L25RSA private key in resources/origin-tls-client-auth/hostname-certificates.js
resources/origin-tls-client-auth/hostname-certificates.jsView on unpkg · L23RSA private key in resources/origin-tls-client-auth/zone-certificates.d.mts
resources/origin-tls-client-auth/zone-certificates.d.mtsView on unpkg · L22Hardcoded password in resources/hyperdrive/configs.d.ts
resources/hyperdrive/configs.d.tsView on unpkg · L20Hardcoded password in resources/hyperdrive/configs.d.ts
resources/hyperdrive/configs.d.tsView on unpkg · L42Hardcoded password in resources/hyperdrive/configs.js
resources/hyperdrive/configs.jsView on unpkg · L21Hardcoded password in resources/hyperdrive/configs.js
resources/hyperdrive/configs.jsView on unpkg · L49Hardcoded password in resources/hyperdrive/configs.mjs
resources/hyperdrive/configs.mjsView on unpkg · L18Hardcoded password in resources/hyperdrive/configs.mjs
resources/hyperdrive/configs.mjsView on unpkg · L46Hardcoded password in resources/hyperdrive/configs.d.mts
resources/hyperdrive/configs.d.mtsView on unpkg · L20Hardcoded password in resources/hyperdrive/configs.d.mts
resources/hyperdrive/configs.d.mtsView on unpkg · L42RSA private key in src/resources/custom-hostnames/certificate-pack/certificates.ts
src/resources/custom-hostnames/certificate-pack/certificates.tsView on unpkg · L34RSA private key in src/resources/origin-tls-client-auth/zone-certificates.ts
src/resources/origin-tls-client-auth/zone-certificates.tsView on unpkg · L30RSA private key in src/resources/origin-tls-client-auth/hostname-certificates.ts
src/resources/origin-tls-client-auth/hostname-certificates.tsView on unpkg · L28Hardcoded password in src/resources/hyperdrive/configs.ts
src/resources/hyperdrive/configs.tsView on unpkg · L28Hardcoded password in src/resources/hyperdrive/configs.ts
src/resources/hyperdrive/configs.tsView on unpkg · L59