registry / @1key4ai/cc-bridge / 1.9.1

@1key4ai/cc-bridge@1.9.1

1K4 Claude Code Bridge — one install, every tool. Plan review, advisors, brainstorm, and the Studio Lab bridge.

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 474 KB of source, external domains: 127.0.0.1, 1key4ai.com, github.com, nodejs.org, staging.1key4ai.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 12-52javascript

12};

13var __export = (target, all) => {

14 for (var name in all)

15 __defProp(target, name, { get: all[name], enumerable: true });

16};

18// ../mcp-core/dist/env.js

19function normalizeApiBase(raw) {

20 const trimmed = raw.replace(/\/$/, "");

21 try {

22 const u = new URL(trimmed);

23 const isOneKey = u.hostname === "1key4ai.com" || u.hostname.endsWith(".1key4ai.com");

24 if (isOneKey && u.hostname.startsWith("api.")) {

25 const host = u.hostname.slice("api.".length);

26 return `${u.protocol}//${host}${u.port ? ":" + u.port : ""}`;

27 }

28 } catch {

29 }

30 return trimmed;

31}

32function getApiBase() {

33 return normalizeApiBase(process.env.K4_API_BASE || process.env.ONEKEY_API_BASE || "https://1key4ai.com");

34}

35function getApiKey() {

36 return process.env.K4_API_KEY || process.env.ONEKEY_API_KEY || "";

37}

38function npxCommand() {

39 return process.platform === "win32" ? "npx.cmd" : "npx";

40}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L32

41function isNpxLikeCommand(command) {

42 return command === "npx" || command === "npx.cmd";

43}

44var init_env = __esm({

45 "../mcp-core/dist/env.js"() {

46 "use strict";

47 }

48});

50// ../mcp-core/dist/fetchWithRetry.js

51function parseRetryAfterSeconds(raw, nowMs = Date.now()) {

52 if (!raw)

Lines 1082-1122javascript

1082 const initial = resolve(startDir || process.cwd());

1083 let dir = initial;

1084 while (true) {

1085 if (existsSync(

•matchType = previous_version_dangerous_delta matchedPackage = @1key4ai/cc-bridge@1.9.0 matchedIdentity = npm:QDFrZXk0YWkvY2MtYnJpZGdl:1.9.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

templates/quorum-enforcement.shView file

•path = templates/quorum-enforcement.sh kind = build_helper sizeBytes = 7455 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/quorum-enforcement.shView on unpkg

dist/setup.jsView file

•matchType = normalized_sha256 matchedPackage = @1key4ai/cc-bridge@1.8.19 matchedPath = dist/setup.js matchedIdentity = npm:QDFrZXk0YWkvY2MtYnJpZGdl:1.8.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/setup.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code