@1sat/cli@0.0.133
CLI for 1Sat Ordinals SDK
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged subprocess is a one-shot monitor started after wallet operations, and its key input is used to initialize the CLI's wallet. Network and file operations align with the package's wallet and CLI features; no concrete malicious behavior was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A detached monitor may start after a wallet command closes, unless a remote store or live monitor is active.
Impact
The reviewed behavior supports wallet monitoring. No unrelated credential or command-output transfer was identified.
Mechanism
The CLI launches its own hidden monitor command, passing the wallet key in the child environment; the monitor initializes the wallet and runs one monitor cycle.
AI rationale
The flagged subprocess is a one-shot monitor started after wallet operations, and its key input is used to initialize the CLI's wallet. Network and file operations align with the package's wallet and CLI features; no concrete malicious behavior was found.
Evidence
~/.1sat/cli/monitor.log~/.1sat-wallet/mcp-agent.keywallet-${chain}.db
Network endpoints3
api.1sat.appapi.whatsonchain.com127.0.0.1:3322
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines build and test scripts, with no install lifecycle hook.
- The CLI entry sets a dotenv flag and imports its command dispatcher.
- After a wallet context closes, the CLI may spawn a detached one-shot monitor; it skips this when a remote store or live monitor is configured.
- The child receives the wallet key through its environment to initialize the same wallet and run its monitor; no source shows the key or command output being sent to an unrelated host.
Evidence against
- The background monitor receives PRIVATE_KEY_WIF and inherits the parent environment, which is sensitive handling but is used to initialize the package's wallet monitor.
- The package supports network requests, including its 1Sat and WhatsOnChain services, and user-directed authenticated requests. No unrelated collector was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @1sat/cli@0.0.125
matchedIdentity = npm:QDFzYXQvY2xp:0.0.125
similarity = 0.739
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg289// src/monitor-once.ts
L290: import { spawn } from "node:child_process";
L291: import { appendFileSync, closeSync, openSync } from "node:fs";
High
109const raw = readFileSync(CONFIG_FILE, "utf8");
L110: const parsed = JSON.parse(raw);
L111: return { ...DEFAULT_CONFIG, ...parsed };
...
L179: var init_config = __esm(() => {
L180: CONFIG_DIR = join(homedir(), ".1sat", "cli");
L181: CONFIG_FILE = join(CONFIG_DIR, "config.json");
...
L190: import { join as join2 } from "node:path";
L191: import { PrivateKey } from "@bsv/sdk";
L192: import { isCancel, password as promptPassword } from "@clack/prompts";
...
L197: function hasKey() {
L198: if (process.env.PRIVATE_KEY_WIF)
L199: return true;
High
Findings
1 Critical2 High2 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/cli.ts
LowAi Review Evidencesrc/context.ts
Affected versions and remediation
This report applies to @1sat/cli@0.0.133.
See all versions of @1sat/cli for other recorded verdicts.
- Review the evidence and your use of @1sat/cli@0.0.133 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.