registry / firecrawl-cli / 1.19.23

firecrawl-cli@1.19.23

Command-line interface for Firecrawl. Scrape, crawl, and extract data from any website directly from your terminal.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 461 KB of source, external domains: api.firecrawl.dev, api.github.com, api.openai.com, example.com, firecrawl.dev, github.com, mcp.firecrawl.dev, news.ycombinator.com, registry.npmjs.org, stripe.com, www.firecrawl.dev

Source & flagged code

5 flagged

dist/utils/auth.jsView file

Lines 29-92javascript

29 return ownKeys(o);

30 };

31 return function (mod) {

32 if (mod && mod.__esModule) return mod;

33 var result = {};

34 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

35 __setModuleDefault(result, mod);

36 return result;

37 };

38})();

39Object.defineProperty(exports, "__esModule", { value: true });

40exports.printBanner = printBanner;

41exports.isAuthenticated = isAuthenticated;

42exports.ensureAuthenticated = ensureAuthenticated;

43exports.browserLogin = browserLogin;

44exports.manualLogin = manualLogin;

45exports.interactiveLogin = interactiveLogin;

46const readline = __importStar(require("readline"));

47const crypto = __importStar(require("crypto"));

48const credentials_1 = require("./credentials");

49const config_1 = require("./config");

50const DEFAULT_API_URL = 'https://api.firecrawl.dev';

51const WEB_URL = 'https://firecrawl.dev';

52const AUTH_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes

53const POLL_INTERVAL_MS = 2000; // 2 seconds

54/**

55 * Prompt for input

56 */

57function promptInput(question) {

58 const rl = readline.createInterface({

59 input: process.stdin,

60 output: process.stdout,

61 });

62 return new Promise((resolve) => {

63 rl.question(question, (answer) => {

64 rl.close();

65 resolve(answer.trim());

66 });

67 });

68}

69/**

70 * Open URL in the default browser

71 */

72async function openBrowser(url) {

73 const { exec } = await Promise.resolve().then(() => __importStar(require('child_process')));

74 const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/utils/auth.jsView on unpkg · L72

75 let command;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils/auth.jsView on unpkg · L49

76 switch (platform) {

77 case 'darwin':

78 command = `open "${url}"`;

79 break;

80 case 'win32':

81 command = `start "" "${url}"`;

82 break;

83 default:

84 command = `xdg-open "${url}"`;

85 }

86 return new Promise((resolve, reject) => {

87 exec(command, (error) => {

88 if (error) {

89 reject(error);

90 }

91 else {

92 resolve();

dist/commands/skills-native.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * Native skill installation — replicates `npx skills add firecrawl/cli --full-depth --global --all`

4 * without requiring Node.js or npx. Used as a fallback for binary installs.

5 */

6var __importDefault = (this && this.__importDefault) || function (mod) {

7 return (mod

dist/commands/init.jsView file

Lines 25-65javascript

25 ownKeys = Object.getOwnPropertyNames || function (o) {

26 var ar = [];

27 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

Source & flagged code

5 flagged · loading source

dist/utils/auth.jsView file

72async function openBrowser(url) { L73: const { exec } = await Promise.resolve().then(() => __importStar(require('child_process'))); L74: const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/utils/auth.jsView on unpkg · L72

49const config_1 = require("./config"); L50: const DEFAULT_API_URL = 'https://api.firecrawl.dev'; L51: const WEB_URL = 'https://firecrawl.dev'; ... L59: input: process.stdin, L60: output: process.stdout, L61: }); ... L72: async function openBrowser(url) { L73: const { exec } = await Promise.resolve().then(() => __importStar(require('child_process'))); L74: const platform = process.platform; L75: let command; ... L103: /** L104: * Generate a PKCE code verifier (random string, base64url encoded)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils/auth.jsView on unpkg · L49

dist/commands/skills-native.jsView file

11exports.hasNpx = hasNpx; L12: const child_process_1 = require("child_process"); L13: const fs_1 = __importDefault(require("fs")); ... L203: function detectInstalledAgents() { L204: const home = os_1.default.homedir(); L205: return AGENTS.filter((agent) => { ... L242: function cloneRepo(tmpDir, repo) { L243: const repoUrl = `https://github.com/${repo}.git`; L244: if (hasGit()) { ... L363: if (fs_1.default.existsSync(lockFilePath)) { L364: lock = JSON.parse(fs_1.default.readFileSync(lockFilePath, 'utf-8')); L365: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/commands/skills-native.jsView on unpkg · L11

dist/commands/init.jsView file

296try { L297: (0, child_process_1.execSync)('npm install -g firecrawl-cli', { stdio: 'inherit' }); L298: console.log(` ${green}✓${reset} CLI installed globally\n`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L296

45exports.handleInitCommand = handleInitCommand; L46: const child_process_1 = require("child_process"); L47: const auth_1 = require("../utils/auth"); ... L121: * inheriting it, so users see a single line per repo. Returns the number of L122: * skills installed (parsed from the captured stdout), or null if unknown. L123: * ... L139: if (isTty) { L140: process.stdout.write(` ${dim}↓ Installing ${label}...${reset}`); L141: } ... L199: console.log(` ${dim}Connect & interact with the web ${reset}${dim}(direct or in your AI agent):${reset}`); L200: console.log(` ${arrow} ${bold}Scrape${reset} "Scrape the pricing page of stripe.com" ${dim}firecrawl scrape https://stripe.com/pricing${reset}`); L201: console.log(` ${arrow} ${bold}Search${reset} "Search for the latest stories in AI" ${dim}firecrawl search "latest stories in AI"${reset}`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/init.jsView on unpkg · L45

Findings

3 High4 Medium6 Low

HighChild Processdist/utils/auth.js

HighSandbox Evasion Gated Capabilitydist/utils/auth.js

HighRuntime Package Installdist/commands/init.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/commands/init.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/commands/skills-native.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/utils/auth.jsView file

Lines 29-92javascript

29 return ownKeys(o);

30 };

31 return function (mod) {

32 if (mod && mod.__esModule) return mod;

33 var result = {};

34 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

35 __setModuleDefault(result, mod);

36 return result;

37 };

38})();

39Object.defineProperty(exports, "__esModule", { value: true });

40exports.printBanner = printBanner;

41exports.isAuthenticated = isAuthenticated;

42exports.ensureAuthenticated = ensureAuthenticated;

43exports.browserLogin = browserLogin;

44exports.manualLogin = manualLogin;

45exports.interactiveLogin = interactiveLogin;

46const readline = __importStar(require("readline"));

47const crypto = __importStar(require("crypto"));

48const credentials_1 = require("./credentials");

49const config_1 = require("./config");

50const DEFAULT_API_URL = 'https://api.firecrawl.dev';

51const WEB_URL = 'https://firecrawl.dev';

52const AUTH_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes

53const POLL_INTERVAL_MS = 2000; // 2 seconds

54/**

55 * Prompt for input

56 */

57function promptInput(question) {

58 const rl = readline.createInterface({

59 input: process.stdin,

60 output: process.stdout,

61 });

62 return new Promise((resolve) => {

63 rl.question(question, (answer) => {

64 rl.close();

65 resolve(answer.trim());

66 });

67 });

68}

69/**

70 * Open URL in the default browser

71 */

72async function openBrowser(url) {

73 const { exec } = await Promise.resolve().then(() => __importStar(require('child_process')));

74 const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/utils/auth.jsView on unpkg · L72

75 let command;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils/auth.jsView on unpkg · L49

76 switch (platform) {

77 case 'darwin':

78 command = `open "${url}"`;

79 break;

80 case 'win32':

81 command = `start "" "${url}"`;

82 break;

83 default:

84 command = `xdg-open "${url}"`;

85 }

86 return new Promise((resolve, reject) => {

87 exec(command, (error) => {

88 if (error) {

89 reject(error);

90 }

91 else {

92 resolve();

dist/commands/skills-native.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * Native skill installation — replicates `npx skills add firecrawl/cli --full-depth --global --all`

4 * without requiring Node.js or npx. Used as a fallback for binary installs.

5 */

6var __importDefault = (this && this.__importDefault) || function (mod) {

7 return (mod

dist/commands/init.jsView file

Lines 25-65javascript

25 ownKeys = Object.getOwnPropertyNames || function (o) {

26 var ar = [];

27 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

Lines 276-316javascript

276 ? `fish_add_path ${bin}`

277 : `export PATH="${bin}:$PATH"`;

278 console.log(` ${dim}Add it to your shell, then restart your terminal:${reset}`);

279 console.log(` ${bold}echo '${line}' >> ${rc}${reset}`);

280 }

281 else {

282 console.log(` ${dim}Add your npm global bin directory (see "npm prefix -g") to PATH.${reset}`);

283 }

284 console.log(` ${dim}Until then you can still run:${reset} ${bold}npx firecrawl-cli <command>${reset}`);

285 console.log('');

286}

287async function stepInstall() {

288 const { confirm } = await Promise.resolve().then(() => __importStar(require('@inquirer/prompts')));

289 const shouldInstall = await confirm({

290 message: 'Install firecrawl-cli globally?',

291 default: true,

292 });

293 if (!shouldInstall)

294 return true;

295 console.log(`\n Installing firecrawl-cli globally...`);

296 try {

297 (0, child_process_1.execSync)('npm install -g firecrawl-cli', { stdio: 'inherit' });

298 console.log(` ${green}✓${reset} CLI installed globally\n`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L296

299 warnIfCliNotOnPath();

300 return true;

301 }

302 catch {

303 console.error('\n Failed to install globally. You may need sudo or fix npm permissions.');

304 return false;

305 }

306}

307async function stepAuth(options) {

308 if (options.apiKey) {

309 try {

310 (0, credentials_1.saveCredentials)({ apiKey: options.apiKey });

311 (0, config_1.updateConfig)({ apiKey: options.apiKey });

312 console.log(` ${green}✓${reset} Authenticated with provided API key\n`);

313 return true;

314 }

315 catch (error) {

316 console.error(' Failed to save credentials:', error instanceof Error ? error.message : 'Unknown error');