registry / resend-cli / 2.17.1
resend-cli@2.17.1
The official CLI for Resend
AI Security Review
scanned 2mo ago · by lpm-firewall-aiScanner labels for exfiltration and persistence are noisy: they match PostHog usage analytics, OS keychain helpers, and ~/.config/resend credential files in a user-invoked official CLI with no install hooks. Source shows package-aligned Resend API, GitHub update, and opt-out telemetry behavior rather than an attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install does not run package code; behavior starts only when a user runs the resend command.
Impact
No confirmed malicious impact. User Resend credentials are stored locally and used against Resend APIs; telemetry sends command metadata, not harvested secrets.
Mechanism
Package-aligned Resend email CLI with optional anonymous telemetry
AI rationale
Scanner labels for exfiltration and persistence are noisy: they match PostHog usage analytics, OS keychain helpers, and ~/.config/resend credential files in a user-invoked official CLI with no install hooks. Source shows package-aligned Resend API, GitHub update, and opt-out telemetry behavior rather than an attack.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The user-run CLI posts anonymous command-usage events to PostHog using a bundled project key.
- The CLI uses child_process for OS credential helpers, opening a browser, and a detached telemetry flush.
- The CLI stores Resend credentials in the user config directory and platform keychains.
Evidence against
- package.json has no preinstall, install, or postinstall scripts; the only entry is the resend binary.
- Telemetry records command name, version, OS, and flags, is schema-checked, and can be turned off with RESEND_TELEMETRY_DISABLED or DO_NOT_TRACK.
- child_process calls target macOS security, Linux secret-tool, Windows PasswordVault, and a browser opener with fixed argument lists.
- Network use is api.resend.com, GitHub releases for this repo, and us.i.posthog.com, which matches an official Resend CLI.
- The skills folder is documentation; doctor only checks whether agent directories exist and does not write agent configs.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
9 flaggeddist/cli.cjsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: "use strict";var ku=Object.create;var vi=Object.defineProperty;var Ru=Object.getOwnPropertyDescriptor;var _u=Object.getOwnPropertyNames;var Du=Object.getPrototypeOf,Eu=Object.proto...
L3: `)}displayWidth(t){return qr(t).length}styleTitle(t){return t}styleUsage(t){return t.split(" ").map(o=>o==="[options]"?this.styleOptionText(o):o==="[command]"?this.styleSubcommandT...
...
L13: (Did you mean one of ${i.join(", ")}?)`:i.length===1?`
L14: (Did you mean ${i[0]}?)`:""}Wr.suggestSimilar=Gu});var Xr=ke(Hi=>{var Hu=require("node:events").EventEmitter,Ii=require("node:child_process"),Ze=require("node:path"),Ko=require("no...
L15: - specify the name in Command constructor or using .name()`);ret
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.cjsView on unpkg · L113(Did you mean one of ${i.join(", ")}?)`:i.length===1?`
L14: (Did you mean ${i[0]}?)`:""}Wr.suggestSimilar=Gu});var Xr=ke(Hi=>{var Hu=require("node:events").EventEmitter,Ii=require("node:child_process"),Ze=require("node:path"),Ko=require("no...
L15: - specify the name in Command constructor or using .name()`);return o=o||{},o.isDefault&&(this._defaultCommandName=t._name),(o.noHelp||o.hidden)&&(t._hidden=!0),this._registerComma...
...
L26: Expecting one of '${i.join("', '")}'`);let r=`${t}Help`;return this.on(r,n=>{let s;typeof o=="function"?s=o({error:n.error,command:n.command}):s=o,s&&n.write(`${s}
L27: `)}),this}_outputHelpIfRequested(t){let o=this._getHelpOption();o&&t.find(r=>o.is(r))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function Yr(e){r...
Findings
3 Critical5 High4 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.cjs
CriticalCommand Output Exfiltrationdist/cli.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/cli.cjs
HighChild Processdist/cli.cjs
HighSame File Env Network Executiondist/cli.cjs
HighSandbox Evasion Gated Capabilitydist/cli.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cli.cjs
HighTrigger Reachable Persistencedist/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.cjs
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to resend-cli@2.17.1.
See all versions of resend-cli for other recorded verdicts.
- Review the evidence and your use of resend-cli@2.17.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.