Loading npm security reports…

@adep/cli@0.2.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @adep/cli / 0.2.0

@adep/cli@0.2.0

`adep` 命令行工具包位：登录 / 初始化 / 本地调试 / 部署 / 数据库维护 / 云存储 / 静态托管 / 微前端组件（widget），实现见任务单 CLI-001 ~ CLI-003 与 FE-002；子路径 `@adep/cli/vite` 提供云函数 vite 插件（CLI-014）

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No attack surface was identified. Network and credential operations are command-driven service functionality, and worker fetches enforce an allowlist.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User runs the adep CLI or invokes a deployed worker function.

Impact

No unconsented installation-time execution, credential harvesting, or exfiltration was established.

Mechanism

The CLI authenticates to its selected service; the worker fetch wrapper validates protocol and host allowlist.

AI rationale

Static inspection found no lifecycle installation hook or concrete malicious behavior. The observed network and credential handling is tied to user-invoked CLI authentication and an allowlisted worker fetch wrapper.

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Evidence for AI clean decision

The manifest exposes a CLI entrypoint and contains no install lifecycle hook.

Source & flagged code

10 flagged · loading source

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @adep/cli@0.1.17 matchedIdentity = npm:QGFkZXAvY2xp:0.1.17 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

31// packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31

16} L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L16

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: await handle.writeFile(JSON.stringify(credentials, null, 2)); return { authorization: `Bearer ${decodeToken(credentials.encodedToken)}` }; if (code === "authorization_pending") { headers: { authorization: `Bearer ${token}` }, "content": "# {{name}}\n\n\u5012\u6570\u65E5 / \u7EAA\u5FF5\u65E5\uFF08countdown \u6A21\u677F\uFF09\u2014\u2014\u7531\u5FAE\u4FE1\u5C0F\u7A0B\u5E8F\u300C\u5012\u6570\u65E5\u300D\u7... "content": "/**\n * \u8BF7\u6C42\u9274\u6743\u5355\u5143\u6D4B\u8BD5\uFF1AOIDC \u8EAB\u4EFD\uFF08ctx.user \u2192 `oidc:<\u5E73\u53F0\u7528\u6237 id>` \u6620\u5C04\uFF09\u4E0E\n * d... "content": "/**\n * \u8BF7\u6C42\u

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L12

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L12

84if (mode !== 384) { L85: const { chmod } = await import("node:fs/promises"); L86: await chmod(file2, 384);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L84

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/index.jsView on unpkg · L12

dist/worker-entry.jsView file

•matchType = normalized_sha256 matchedPackage = @adep/cli@0.1.12 matchedPath = dist/worker-entry.js matchedIdentity = npm:QGFkZXAvY2xp:0.1.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/worker-entry.jsView on unpkg

Source & flagged code

10 flagged

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @adep/cli@0.1.17 matchedIdentity = npm:QGFkZXAvY2xp:0.1.17 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

31// packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L31

16} L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L16

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: await handle.writeFile(JSON.stringify(credentials, null, 2)); return { authorization: `Bearer ${decodeToken(credentials.encodedToken)}` }; if (code === "authorization_pending") { headers: { authorization: `Bearer ${token}` }, "content": "# {{name}}\n\n\u5012\u6570\u65E5 / \u7EAA\u5FF5\u65E5\uFF08countdown \u6A21\u677F\uFF09\u2014\u2014\u7531\u5FAE\u4FE1\u5C0F\u7A0B\u5E8F\u300C\u5012\u6570\u65E5\u300D\u7... "content": "/**\n * \u8BF7\u6C42\u9274\u6743\u5355\u5143\u6D4B\u8BD5\uFF1AOIDC \u8EAB\u4EFD\uFF08ctx.user \u2192 `oidc:<\u5E73\u53F0\u7528\u6237 id>` \u6620\u5C04\uFF09\u4E0E\n * d... "content": "/**\n * \u8BF7\u6C42\u

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L12

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L12

84if (mode !== 384) { L85: const { chmod } = await import("node:fs/promises"); L86: await chmod(file2, 384);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L84

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L31: // packages/cli/src/browser.ts L32: import { spawn } from "node:child_process"; L33: function browserOpenCommand(url2, platform) { ... L40: if (env["ADEP_NO_BROWSER"] === "1") return false; L41: const isTty = options.isTty ?? process.stdout.isTTY === true; L42: return isTty;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/index.jsView on unpkg · L12

dist/worker-entry.jsView file

•matchType = normalized_sha256 matchedPackage = @adep/cli@0.1.12 matchedPath = dist/worker-entry.js matchedIdentity = npm:QGFkZXAvY2xp:0.1.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/worker-entry.jsView on unpkg