All cli versions

[email protected] rejected Risk: 53 MIT

cli @0.11.3

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
53
Risk Score
MIT
License
No
Install Scripts
2
Dependencies
0
Dev Dependencies
15.9 KB
Package Size
Published

A tool for rapidly building command line apps

Maintainers

cohara87

Keywords

clicommand lineoptsparseoptoptargsconsoleargsparseoptparsedaemonautocompletecommandautocompletion

Dependencies (2)

PackageConstraintRegistry Status
exit 0.1.2 auto_approved
glob ^7.0.5 auto_approved

Transitive Dependency Tree

12 transitive deps max depth 4
  ├─ exit 0.1.2 → 0.1.2
├─ glob ^7.0.5 → 7.1.7
  ├─ fs.realpath ^1.0.0
  ├─ inflight ^1.0.4
  ├─ inherits 2 → 2.0.4
  ├─ minimatch ^3.0.4 → 3.1.5
  ├─ once ^1.3.0 → 1.4.0
├─ path-is-absolute ^1.0.0 → 1.0.1
  ├─ brace-expansion ^1.1.7 → 1.1.15
├─ wrappy 1 → 1.0.2
  ├─ balanced-match ^1.0.0 → 1.0.2
  ├─ concat-map 0.0.1 → 0.0.1

Risk Dispositions (1 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
osv:GHSA-6cpc-mj5c-m9rq osv reject AI AI (osv): Arbitrary file write via symlink attack on predictable temp files; affects all versions < 1.0.0. Fix available in 1.0.0. Verdict generalizes to all versions in the affected range.

SAST Findings (2)

CRITICAL GHSA-6cpc-mj5c-m9rq: Arbitrary File Write in cli osv

[Always reject] Affected versions of `cli` use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the `cli` process has permission to write to. ## Proof of Concept By creating Symbolic Links at the following locations, the target of the link can be written to. ``` lock_file = '/tmp/' + cli.app + '.pid', log_file = '/tmp/' + cli.app + '.log'; ``` ## Recommendation Update to version 1.0.0 or later.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Review Summary

Risk score: 53. Findings: 1 critical (+40), 1 medium (+10), 1 low (+3), 1 info (+0).

Commit: 42e8cecab6f7 Browse source

Published to npm: