registry / periderm-cli / 0.1.39

periderm-cli@0.1.39

Pre-launch scanner for web and mobile codebases. Context-aware checks for JS, TS, Flutter, React Native, and Swift.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Network and filesystem behavior is tied to explicit CLI commands for login, scanning, update checks, crash reporting, and optional AI review.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs periderm CLI commands such as scan, login, review --deep, watch, or whoami.

Impact

Can read source files during scans and write .periderm reports; can transmit findings/metadata to configured Periderm endpoints, Formspree crash endpoint, npm registry, or Groq when invoked.

Mechanism

Authenticated project scanner with report generation, optional upload, update check, and crash telemetry.

Rationale

Static inspection shows a legitimate CLI scanner with user-invoked network/reporting behavior and no lifecycle execution, payload staging, credential harvesting, destructive behavior, or hidden persistence. Scanner hints map to package-aligned source reading, AI review, telemetry, and update-check functionality rather than concrete malware.

Evidence

package.jsondist/bin.jsdist/index.jsdist/api.jsdist/config.jsdist/error-report.jsdist/scanner/repo-checks.jsdist/scanner/context-agent.jsdist/review/deep.js~/.periderm/config.json.periderm/last-report.md.periderm/last-report.json.periderm/ai-instructions.md.periderm/.gitignore

Network endpoints8

registry.npmjs.org/${name}/latest${apiUrl}/api/public/verify-token${apiUrl}/api/public/scan${apiUrl}/api/policies${apiUrl}/api/public/deep-review${apiUrl}/api/public/report-errorformspree.io/f/mqakppnnapi.groq.com/openai/v1/chat/completions

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/error-report.js posts crash reports with command/cwd/platform/hostname to Formspree and configured API after CLI errors.
dist/scanner/context-agent.js can call Periderm deep-review API or Groq when AI context/review is invoked.
dist/index.js writes scan reports under target .periderm/ and stores login token in ~/.periderm/config.json.

Evidence against

package.json has no install/preinstall/postinstall/prepare lifecycle hooks; only bin is ./dist/bin.js.
dist/bin.js only starts update check and imports CLI entrypoint; no install-time execution.
dist/scanner/repo-checks.js reads project files for scanner heuristics and emits findings/prompts; no exfiltration or execution of scanned code found.
dist/api.js uploads structured scan findings to user-configured Periderm API after authenticated scan command, package-aligned behavior.
dist/review/deep.js constrains AI tool reads to project root and excludes node_modules/dist/.git in search.
No child_process, eval/vm/Function, native binary loading, persistence, destructive actions, or AI-agent control-surface writes found.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 183 KB of source, external domains: 127.0.0.1, api.groq.com, formspree.io, registry.npmjs.org, www.w3.org, your-domain.com

Source & flagged code

2 flagged

dist/scanner/repo-checks.jsView file

Lines 293-333javascript

293 id: "unused-dependencies",

294 category: "Performance & Bundle Size",

295 severity: "medium",

296 file: "package.json", line: 1,

297 message: `${unused.length} dependenc${unused.length === 1 ? "y" : "ies"} in package.json appear unused: ${shown.join(", ")}${unused.length > shown.length ? ", …" : ""}.`,

298 why: "Unused deps still get installed, audited, and (if imported anywhere transitively) can end up in the bundle. They also slow every CI install and confuse new contributors.",

299 fix: "Verify each one, then `npm uninstall <pkg>` for the true zombies. Move build-only tools to devDependencies.",

300 aiPrompt: `The following dependencies have no import in the source tree: ${unused.join(", ")}. For each, decide whether to remove it (unused), move it to devDependencies (build/tool-only), or add the missing import (mistakenly deleted).`,

301 });

302 }

303 // Code-splitting heuristic: many routes, zero dynamic imports

304 const routeFiles = _files.filter((f) => /\/(routes|pages|app)\//.test(f) && /\.(tsx|jsx)$/.test(f));

305 const dynamicImportHits = (importHaystack.match(/\bReact\.lazy\s*$|\blazy\s*\(\s*\(\s*$\s*=>\s*import\(|\bimport\(\s*["']/g) ?? []).length;

306 if (routeFiles.length >= 12 && dynamicImportHits === 0) {

307 out.push({

308 id: "no-code-splitting",

309 category: "Performance & Bundle Size",

310 severity: "medium",

311 file: "src", line: 1,

312 message: `${routeFiles.length} routes/pages and zero dynamic imports — everything ships in one bundle.`,

313 why: "Without code-splitting, a visitor to your landing page also downloads the admin dashboard, the settings screens, and every modal. First paint gets slower with every feature you add.",

314 fix: "Wrap heavy or rarely-used routes in React.lazy(() => import('./Route')) + <Suspense>, or use your router's built-in lazy() API. Split third-party charts, editors and 3D scenes the same way.",

315 aiPrompt: `This project has ${routeFiles.length} route files but no dynamic import()/React.lazy usage. Identify the largest / least-visited routes (admin, settings, editors, charts) and refactor them to React.lazy() + <Suspense fallback={...}> so they code-split out of the initial bundle.`,

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scanner/repo-checks.jsView on unpkg · L313

316 });

317 }

318 }

319 // ─────────────────────────────────────────────────────────────────────

320 // Unused CSS classes (skip Tailwind / CSS-modules)

321 // ─────────────────────────────────────────────────────────────────────

322 const cssFiles = await fg(["**/*.css", "!**/node_modules/**", "!**/dist/**", "!**/build/**", "!**/.next/**", "!**/.output/**", "!**/*.module.css"], { cwd: root, absolute: true, dot: false });

323 if (cssFiles.length) {

324 // Build a haystack of everything CSS classes might be referenced from.

325 let refHaystack = "";

326 for (const abs of _files) {

327 if (!/\.(tsx|jsx|ts|js|mjs|cjs|svelte|vue|astro|html?|mdx?)$/.test(abs))

328 continue;

329 const chunk = await readMaybe(abs);

330 if (chunk)

331 refHaystack += chunk + "\n";

332 }

333 for (const cssAbs of cssFiles) {

dist/scanner/checks.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = periderm-cli@0.1.38 matchedIdentity = npm:cGVyaWRlcm0tY2xp:0.1.38 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/scanner/checks.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/scanner/repo-checks.jsView file

313why: "Without code-splitting, a visitor to your landing page also downloads the admin dashboard, the settings screens, and every modal. First paint gets slower with every feature y... L314: fix: "Wrap heavy or rarely-used routes in React.lazy(() => import('./Route')) + <Suspense>, or use your router's built-in lazy() API. Split third-party charts, editors and 3D scene... L315: aiPrompt: `This project has ${routeFiles.length} route files but no dynamic import()/React.lazy usage. Identify the largest / least-visited routes (admin, settings, editors, charts...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scanner/repo-checks.jsView on unpkg · L313

dist/scanner/checks.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/scanner/checks.jsView on unpkg

Findings

1 Critical3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/scanner/checks.js

MediumDynamic Requiredist/scanner/repo-checks.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/scanner/repo-checks.jsView file

Lines 293-333javascript

293 id: "unused-dependencies",

294 category: "Performance & Bundle Size",

295 severity: "medium",

296 file: "package.json", line: 1,

297 message: `${unused.length} dependenc${unused.length === 1 ? "y" : "ies"} in package.json appear unused: ${shown.join(", ")}${unused.length > shown.length ? ", …" : ""}.`,

298 why: "Unused deps still get installed, audited, and (if imported anywhere transitively) can end up in the bundle. They also slow every CI install and confuse new contributors.",

299 fix: "Verify each one, then `npm uninstall <pkg>` for the true zombies. Move build-only tools to devDependencies.",

301 });

302 }

303 // Code-splitting heuristic: many routes, zero dynamic imports

304 const routeFiles = _files.filter((f) => /\/(routes|pages|app)\//.test(f) && /\.(tsx|jsx)$/.test(f));

305 const dynamicImportHits = (importHaystack.match(/\bReact\.lazy\s*$|\blazy\s*\(\s*\(\s*$\s*=>\s*import\(|\bimport\(\s*["']/g) ?? []).length;

306 if (routeFiles.length >= 12 && dynamicImportHits === 0) {

307 out.push({

308 id: "no-code-splitting",

309 category: "Performance & Bundle Size",

310 severity: "medium",

311 file: "src", line: 1,

312 message: `${routeFiles.length} routes/pages and zero dynamic imports — everything ships in one bundle.`,

313 why: "Without code-splitting, a visitor to your landing page also downloads the admin dashboard, the settings screens, and every modal. First paint gets slower with every feature you add.",

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scanner/repo-checks.jsView on unpkg · L313

316 });

317 }

318 }

320 // Unused CSS classes (skip Tailwind / CSS-modules)

322 const cssFiles = await fg(["**/*.css", "!**/node_modules/**", "!**/dist/**", "!**/build/**", "!**/.next/**", "!**/.output/**", "!**/*.module.css"], { cwd: root, absolute: true, dot: false });

323 if (cssFiles.length) {

324 // Build a haystack of everything CSS classes might be referenced from.

325 let refHaystack = "";

326 for (const abs of _files) {

327 if (!/\.(tsx|jsx|ts|js|mjs|cjs|svelte|vue|astro|html?|mdx?)$/.test(abs))

328 continue;

329 const chunk = await readMaybe(abs);

330 if (chunk)

331 refHaystack += chunk + "\n";

332 }

333 for (const cssAbs of cssFiles) {

dist/scanner/checks.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/scanner/checks.jsView on unpkg