registry / resend-cli / 2.24.0
resend-cli@2.24.0
The official CLI for Resend
AI Security Review
scanned 21d ago · by lpm-firewall-aiSource inspection found default usage telemetry with a bounded event schema and explicit opt-outs, but no concrete attack behavior. The scanner's execution and persistence indicators correspond to CLI functionality rather than an install-time attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a regular CLI command; update and telemetry commands are excluded.
Impact
The inspected code supports usage analytics; it does not establish credential theft or command-output exfiltration.
Mechanism
The CLI queues a cli.used event with command and environment metadata, then posts it to the PostHog collector. Telemetry has environment-variable opt-outs.
AI rationale
Source inspection found default usage telemetry with a bounded event schema and explicit opt-outs, but no concrete attack behavior. The scanner's execution and persistence indicators correspond to CLI functionality rather than an install-time attack.
Evidence
dist/cli.cjs
Network endpoints1
us.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/cli.cjs as the CLI and has no install lifecycle hook; its listed prepack script builds the bundle.
- The bundle queues a cli.used event with command, version, platform, Node version, interaction status, install method, and flag names.
- The telemetry path is called after a regular CLI command; update and telemetry commands are excluded.
- The bundle validates the usage event and sends it to the Resend CLI's PostHog collector.
- DO_NOT_TRACK=1 and RESEND_TELEMETRY_DISABLED=1 disable telemetry.
Evidence against
- Usage telemetry is enabled by default and stores an anonymous identifier locally.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
10 flaggeddist/cli.cjsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: "use strict";var zm=Object.create;var Hi=Object.defineProperty;var Ym=Object.getOwnPropertyDescriptor;var Xm=Object.getOwnPropertyNames;var Zm=Object.getPrototypeOf,ep=Object.proto...
L3: `)}displayWidth(t){return gn(t).length}styleTitle(t){return t}styleUsage(t){return t.split(" ").map(o=>o==="[options]"?this.styleOptionText(o):o==="[command]"?this.styleSubcommandT...
...
L13: (Did you mean one of ${i.join(", ")}?)`:i.length===1?`
L14: (Did you mean ${i[0]}?)`:""}bn.suggestSimilar=lp});var vn=De(ir=>{var dp=require("node:events").EventEmitter,Zi=require("node:child_process"),it=require("node:path"),Io=require("no...
L15: - specify the name in Command constructor or using .name()`);ret
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.cjsView on unpkg · L113(Did you mean one of ${i.join(", ")}?)`:i.length===1?`
L14: (Did you mean ${i[0]}?)`:""}bn.suggestSimilar=lp});var vn=De(ir=>{var dp=require("node:events").EventEmitter,Zi=require("node:child_process"),it=require("node:path"),Io=require("no...
L15: - specify the name in Command constructor or using .name()`);return o=o||{},o.isDefault&&(this._defaultCommandName=t._name),(o.noHelp||o.hidden)&&(t._hidden=!0),this._registerComma...
...
L26: Expecting one of '${i.join("', '")}'`);let r=`${t}Help`;return this.on(r,n=>{let a;typeof o=="function"?a=o({error:n.error,command:n.command}):a=o,a&&n.write(`${a}
L27: `)}),this}_outputHelpIfRequested(t){let o=this._getHelpOption();o&&t.find(r=>o.is(r))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function wn(e){r...
Findings
3 Critical5 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.cjs
CriticalCommand Output Exfiltrationdist/cli.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/cli.cjs
HighChild Processdist/cli.cjs
HighSame File Env Network Executiondist/cli.cjs
HighSandbox Evasion Gated Capabilitydist/cli.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cli.cjs
HighTrigger Reachable Persistencedist/cli.cjs
MediumDynamic Requiredist/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.cjs
Medium
Affected versions and remediation
This report applies to resend-cli@2.24.0.
See all versions of resend-cli for other recorded verdicts.
- Review the evidence and your use of resend-cli@2.24.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.