prismic@1.20.0
Prismic's official command line tool
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is the Prismic CLI: its only runtime entry is a user-run bin, and authentication stays on the Prismic host unless the caller sets the host or token. No install hook, self-install chain, or hidden payload was present in the inspected sources.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A person runs the prismic binary; installation does not execute package code.
Impact
No unconsented credential theft, remote payload execution, persistence, or agent control-surface mutation was found.
Mechanism
Commands talk to Prismic hosts using a default of prismic.io or an explicit host and token from the environment or a local login file.
AI rationale
The package is the Prismic CLI: its only runtime entry is a user-run bin, and authentication stays on the Prismic host unless the caller sets the host or token. No install hook, self-install chain, or hidden payload was present in the inspected sources.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json publishes a user-invoked prismic CLI bin at dist/index.mjs and has no preinstall, install, or postinstall hook.
- Auth defaults the API host to prismic.io and uses a caller-supplied PRISMIC_TOKEN or a token saved after explicit login.
- dist/index.mjs only registers repository, docs, and project commands that run when the user executes the CLI.
Evidence against
- Segment telemetry and a configurable PRISMIC_HOST exist, but both are first-party CLI behavior and are not an install-time or hidden exfiltration path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
•name = prismic; similarTo = prisma
Medium
Typosquat Name
Package name is suspiciously similar to a popular package name.
package.jsonView on unpkgdist/core-WSKksPQW.mjsView file
7`))&&!t?.force?e:xt(e)+`
L8: `}function X(e,t){return St(t)+e}const Ct=`https://prismic.io/docs/slices`,wt={UID:`https://prismic.io/docs/fields/uid`,Boolean:`https://prismic.io/docs/fields/boolean`,Color:`http...
L9: /**
...
L166: }
L167: `,r)}return r}var jn=L(import.meta.url);function Mn(e){let t=j(e);return t.length>1&&t[t.length-1]===F&&(t=t.substring(0,t.length-1)),t}const Nn=/[\\/]/g;function Pn(e,t){return e....
L168: `),l=null;for(let e of c){let t=e.match(/^(\s+)\S+/);if(t){let e=t[1].length;l=l?Math.min(l,e):e}}if(l!==null){let e=l;s=c.map(t=>t[0]===` `||t[0]===` `?t.slice(e):t).join(`
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/core-WSKksPQW.mjsView on unpkg · L7dist/auth-BuGjgvJf.mjsView file
Findings
2 High4 Medium7 Low
HighSandbox Evasion Gated Capabilitydist/auth-BuGjgvJf.mjs
HighPrevious Version Dangerous Deltadist/index.mjs
MediumTyposquat Namepackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowWeak Cryptodist/core-WSKksPQW.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to prismic@1.20.0.
See all versions of prismic for other recorded verdicts.
- Review the evidence and your use of prismic@1.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.