All cli versions

[email protected] rejected Risk: 43 MIT

cli @0.4.3

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
43
Risk Score
MIT
License
No
Install Scripts
1
Dependencies
0
Dev Dependencies
14.2 KB
Package Size
Published

A tool for rapidly building command line apps

Maintainers

cohara87

Keywords

clicommand lineoptsparseoptoptargsconsoleargsparseoptparsedaemonautocompletecommandautocompletion

Dependencies (1)

PackageConstraintRegistry Status
glob >= 3.1.4 auto_approved

Transitive Dependency Tree

7 transitive deps max depth 4
├─ glob >= 3.1.4 → 13.0.6
  ├─ minimatch ^10.2.2 → 10.2.5
  ├─ minipass ^7.1.3 → 7.1.3
├─ path-scurry ^2.0.2 → 2.0.2
  ├─ brace-expansion ^5.0.5 → 5.0.6
  ├─ lru-cache ^11.0.0 → 11.5.1
├─ minipass ^7.1.2 → 7.1.3
  ├─ balanced-match ^4.0.2 → 4.0.4

Risk Dispositions (1 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
osv:GHSA-6cpc-mj5c-m9rq osv reject AI AI (osv): Arbitrary file write via symlink attack on predictable temp files; affects all versions < 1.0.0. Fix available in 1.0.0. Verdict generalizes to all versions in the affected range.

SAST Findings (2)

CRITICAL GHSA-6cpc-mj5c-m9rq: Arbitrary File Write in cli osv

[Always reject] Affected versions of `cli` use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the `cli` process has permission to write to. ## Proof of Concept By creating Symbolic Links at the following locations, the target of the link can be written to. ``` lock_file = '/tmp/' + cli.app + '.pid', log_file = '/tmp/' + cli.app + '.log'; ``` ## Recommendation Update to version 1.0.0 or later.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Review Summary

Risk score: 43. Findings: 1 critical (+40), 1 low (+3), 1 info (+0).

Published to npm: