registry / 1688-claw / 0.1.0

1688-claw@0.1.0

Standalone read-only 1688 product collection CLI for keyword, image, offer, and official similar searches.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 155 KB of source, external domains: air.1688.com, cbu01.alicdn.com, detail.1688.com, detail.m.1688.com, login.1688.com, myalibaba.1688.com, npmmirror.com, s.1688.com

Source & flagged code

6 flagged

package.jsonView file

Lines 20-42json

20 },

21 "type": "module",

22 "dependencies": {

23 "commander": "^12.1.0",

24 "iconv-lite": "^0.7.2",

25 "playwright": "^1.48.0",

26 "playwright-extra": "^4.3.6",

27 "proper-lockfile": "^4.1.2",

28 "puppeteer-extra-plugin-stealth": "^2.11.2",

29 "qrcode": "^1.5.4"

30 },

31 "devDependencies": {

32 "esbuild": "^0.28.1",

33 "typescript": "^5.6.0"

34 },

35 "scripts": {

36 "1688": "node dist/cli.js",

37 "build": "pnpm -r build && node scripts/build.mjs",

38 "dev": "pnpm --filter @standalone-1688/cli dev",

39 "typecheck": "pnpm -r typecheck",

40 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 }

42}

scripts/postinstall.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2// Best-effort browser setup. A failed download never fails npm installation.

3import { spawnSync } from 'node:child_process';

4import fs from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L2

5import os from 'node:os';

6import

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

2// Best-effort browser setup. A failed download never fails npm installation. L3: import { spawnSync } from 'node:child_process'; L4: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L2

2Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L2: // Best-effort browser setup. A failed download never fails npm installation. L3: import { spawnSync } from 'node:child_process'; L4: import fs from 'node:fs'; ... L7: L8: if (process.env.CI || process.env.COLLECTION_1688_SKIP_POSTINSTALL) process.exit(0); L9: ... L27: if (process.env.PLAYWRIGHT_BROWSERS_PATH) return process.env.PLAYWRIGHT_BROWSERS_PATH; L28: if (process.platform === 'darwin') return path.join(os.homedir(), 'Library/Caches/ms-playwright'); L29: if (process.platform === 'win32') return path.join(process.env.LOCALAPPDATA ?? os.homedir(), 'ms-playwright'); ... L36: return /Asia\/(Shanghai|Chongqing|Harbin|Urumqi|Kashgar|Hong_Kong|Macau)/.test(timezone) L37: ? 'https://npmmirror.com/mirrors/playwright' L38: : '';

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/postinstall.mjsView on unpkg · L2

2// Best-effort browser setup. A failed download never fails npm installation. L3: import { spawnSync } from 'node:child_process'; L4: import fs from 'node:fs'; ... L7: L8: if (process.env.CI || process.env.COLLECTION_1688_SKIP_POSTINSTALL) process.exit(0); L9: ... L27: if (process.env.PLAYWRIGHT_BROWSERS_PATH) return process.env.PLAYWRIGHT_BROWSERS_PATH; L28: if (process.platform === 'darwin') return path.join(os.homedir(), 'Library/Caches/ms-playwright'); L29: if (process.platform === 'win32') return path.join(process.env.LOCALAPPDATA ?? os.homedir(), 'ms-playwright'); ... L36: return /Asia\/(Shanghai|Chongqing|Harbin|Urumqi|Kashgar|Hong_Kong|Macau)/.test(timezone) L37: ? 'https://npmmirror.com/mirrors/playwright' L38: : '';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.mjsView on unpkg · L2

54console.log(`1688-claw: 正在下载 Playwright Chromium（约 150 MB）${host ? '，使用 npmmirror 镜像。' : '。'}`); L55: const result = spawnSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['playwright', 'install', 'chromium'], { L56: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.mjsView on unpkg · L54

Findings

6 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall.mjs

HighShell

HighEntrypoint Build Divergencescripts/postinstall.mjs

HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs

HighRuntime Package Installscripts/postinstall.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 20-42json

20 },

21 "type": "module",

22 "dependencies": {

23 "commander": "^12.1.0",

24 "iconv-lite": "^0.7.2",

25 "playwright": "^1.48.0",

26 "playwright-extra": "^4.3.6",

27 "proper-lockfile": "^4.1.2",

28 "puppeteer-extra-plugin-stealth": "^2.11.2",

29 "qrcode": "^1.5.4"

30 },

31 "devDependencies": {

32 "esbuild": "^0.28.1",

33 "typescript": "^5.6.0"

34 },

35 "scripts": {

36 "1688": "node dist/cli.js",

37 "build": "pnpm -r build && node scripts/build.mjs",

38 "dev": "pnpm --filter @standalone-1688/cli dev",

39 "typecheck": "pnpm -r typecheck",

40 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 }

42}

scripts/postinstall.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2// Best-effort browser setup. A failed download never fails npm installation.

3import { spawnSync } from 'node:child_process';

4import fs from 'node:fs';

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L2

5import os from 'node:os';

6import

Lines 34-65javascript

34 if (process.env.PLAYWRIGHT_DOWNLOAD_HOST) return process.env.PLAYWRIGHT_DOWNLOAD_HOST;

35 const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone ?? '';

37 ? 'https://npmmirror.com/mirrors/playwright'

38 : '';

39}

41if (hasSystemChrome()) {

42 console.log('1688-claw: 检测到本机 Google Chrome，跳过 Chromium 下载。');

43 process.exit(0);

44}

46const cache = chromiumCacheDir();

47const cached = fs.existsSync(cache) && fs.readdirSync(cache).some((name) => name.startsWith('chromium'));

48if (cached) {

49 console.log('1688-claw: Playwright Chromium 已存在，跳过下载。');

50 process.exit(0);

51}

53const host = downloadHost();

54console.log(`1688-claw: 正在下载 Playwright Chromium（约 150 MB）${host ? '，使用 npmmirror 镜像。' : '。'}`);

55const result = spawnSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['playwright', 'install', 'chromium'], {

56 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.mjsView on unpkg · L54

57 env: { ...process.env, ...(host ? { PLAYWRIGHT_DOWNLOAD_HOST: host } : {}) },

58});

60if (result.status !== 0) {

61 console.log('\n1688-claw: Chromium 下载失败，但 npm 安装未中断。');

62 console.log('请安装 Google Chrome，或执行：');

63 console.log('PLAYWRIGHT_DOWNLOAD_HOST=https://npmmirror.com/mirrors/playwright npx playwright install chromium');

64}