registry  /  @aldenwangexis/yx-cli  /  1.7.1

@aldenwangexis/yx-cli@1.7.1

Yunxiao command line client

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystem
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 7 file(s), 9.15 KB of source

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/install-skill.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
bin/yx.jsView file
3L4: const { spawnSync } = require("node:child_process"); L5: const fs = require("node:fs");
High
Child Process

Package source references child process execution.

bin/yx.jsView on unpkg · L3
20console.error(`yx npm wrapper could not find platform package ${platformPackage.name}.`); L21: console.error("Try reinstalling: npm install -g @aldenwangexis/yx-cli"); L22: process.exit(1); ... L33: L34: const result = spawnSync(binaryPath, process.argv.slice(2), { L35: stdio: "inherit",
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/yx.jsView on unpkg · L20
3L4: const { spawnSync } = require("node:child_process"); L5: const fs = require("node:fs");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/yx.jsView on unpkg · L3

Findings

3 High3 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/yx.js
HighRuntime Package Installbin/yx.js
MediumDynamic Requirebin/yx.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem