registry / resend-cli / 2.8.1
resend-cli@2.8.1
⚠ Under reviewThe official CLI for Resend
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
7 flaggeddist/cli.cjsView file
13(Did you mean one of ${i.join(", ")}?)`:i.length===1?`
L14: (Did you mean ${i[0]}?)`:""}jr.suggestSimilar=Lu});var Qr=we(Di=>{var Wu=require("node:events").EventEmitter,xi=require("node:child_process"),ze=require("node:path"),Ao=require("no...
L15: - specify the name in Command constructor or using .name()`);return o=o||{},o.isDefault&&(this._defaultCommandName=t._name),(o.noHelp||o.hidden)&&(t._hidden=!0),this._registerComma...
...
L26: Expecting one of '${i.join("', '")}'`);let r=`${t}Help`;return this.on(r,n=>{let s;typeof o=="function"?s=o({error:n.error,command:n.command}):s=o,s&&n.write(`${s}
L27: `)}),this}_outputHelpIfRequested(t){let o=this._getHelpOption();o&&t.find(r=>o.is(r))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function Hr(e){r...
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/cli.cjsView on unpkg · L1313Trigger-reachable chain: manifest.bin -> dist/cli.cjs
L13: (Did you mean one of ${i.join(", ")}?)`:i.length===1?`
L14: (Did you mean ${i[0]}?)`:""}jr.suggestSimilar=Lu});var Qr=we(Di=>{var Wu=require("node:events").EventEmitter,xi=require("node:child_process"),ze=require("node:path"),Ao=require("no...
L15: - specify the name in Command constructor or using .name()`);return o=o||{},o.isDefault&&(this._defaultCommandName=t._name),(o.noHelp||o.hidden)&&(t._hidden=!0),this._registerComma...
...
L26: Expecting one of '${i.join("', '")}'`);let r=`${t}Help`;return this.on(r,n=>{let s;typeof o=="function"?s=o({error:n.error,command:n.command}):s=o,s&&n.write(`${s}
L27: `)}),this}_outputHelpIfRequested(t){let o=this._getHelpOption();o&&t.find(r=>o.is(r))&&(this.outputHelp(),this._exit(0,"commander.
Findings
2 Critical3 High5 Medium5 Low
CriticalCommand Output Exfiltrationdist/cli.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/cli.cjs
HighChild Processdist/cli.cjs
HighSame File Env Network Executiondist/cli.cjs
HighSandbox Evasion Gated Capabilitydist/cli.cjs
MediumDynamic Requiredist/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.cjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to resend-cli@2.8.1.
See all versions of resend-cli for other recorded verdicts.
- Review the evidence and your use of resend-cli@2.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.