registry / @alicloud/eiam20211201 / 2.17.1

@alicloud/eiam20211201@2.17.1

English | [简体中文](README-CN.md) ![](https://aliyunsdk-pages.alicdn.com/icons/AlibabaCloud.svg)

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a generated Alibaba Cloud EIAM SDK with user-invoked API calls and data model classes.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports the SDK and explicitly calls client methods.

Impact

Expected Alibaba Cloud EIAM API requests only; no install-time execution or local credential/file harvesting observed.

Mechanism

Generated OpenAPI RPC client

Rationale

Static source inspection shows a generated Alibaba Cloud SDK with publish-time TypeScript compilation and user-invoked HTTPS API methods. The scanner secret hit is a request model property named password, not embedded credentials or exfiltration code.

Evidence

package.jsondist/client.jssrc/client.tsdist/models/CreateUserRequest.jssrc/models/CreateUserRequest.tsREADME.md

Network endpoints6

eiam.eu-central-1.aliyuncs.comeiam.cn-hongkong.aliyuncs.comeiam.cn-hangzhou.aliyuncs.comeiam.ap-southeast-5.aliyuncs.comeiam.ap-southeast-1.aliyuncs.comeiam.ap-northeast-2.aliyuncs.com

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json has prepublishOnly script, but it is publish-time tsc, not install-time execution.
dist/models/CreateUserRequest.js contains a password field model, matching the scanner secret-pattern hint but not a hardcoded secret.

Evidence against

package.json has no preinstall/install/postinstall/prepare hooks and no bin entry.
dist/client.js is an auto-generated Alibaba Cloud OpenAPI client; methods call this.callApi only when user invokes SDK methods.
dist/client.js imports only @darabonba/typescript, @alicloud/openapi-core, and local models.
rg found no child_process, fs file I/O, process.env harvesting, eval/Function, native binaries, or AI-agent control-surface writes.
Network hosts are Alibaba EIAM service endpoints in the client endpoint map.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2,092 file(s), 6.68 MB of source

Source & flagged code

4 flagged

dist/models/CreateUserRequest.jsView file

Lines 79-119javascript

79 $dara.Model.validateArray(this.userNotificationChannels);

80 }

81 super.validate();

82 }

83 constructor(map) {

84 super(map);

85 }

86}

87exports.CreateUserRequestPasswordInitializationConfig = CreateUserRequestPasswordInitializationConfig;

88class CreateUserRequest extends $dara.Model {

89 static names() {

90 return {

91 clientToken: 'ClientToken',

92 customFields: 'CustomFields',

93 description: 'Description',

94 displayName: 'DisplayName',

95 email: 'Email',

96 emailVerified: 'EmailVerified',

97 instanceId: 'InstanceId',

98 organizationalUnitIds: 'OrganizationalUnitIds',

99 password: 'Password',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/models/CreateUserRequest.jsView on unpkg · L99

100 passwordInitializationConfig: 'PasswordInitializationConfig',

101 phoneNumber: 'PhoneNumber',

102 phoneNumberVerified: 'PhoneNumberVerified',

103 phoneRegion: 'PhoneRegion',

104 primaryOrganizationalUnitId: 'PrimaryOrganizationalUnitId',

105 userExternalId: 'UserExternalId',

106 username: 'Username',

107 };

108 }

109 static types() {

110 return {

111 clientToken: 'string',

112 customFields: { 'type': 'array', 'itemType': CreateUserRequestCustomFields },

113 description: 'string',

114 displayName: 'string',

115 email: 'string',

116 emailVerified: 'boolean',

117 instanceId: 'string',

118 organizationalUnitIds: { 'type': 'array', 'itemType': 'string' },

119 password: 'string',

dist/models/UpdateUserPasswordRequest.jsView file

Lines 23-63javascript

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var

src/models/CreateUserRequest.tsView file

Lines 232-272typescript

232 /**

233 * @remarks

234 * The username. The username can contain letters, digits, underscores (_), periods (.), at signs (@), and hyphens (-). The username can be up to 256 characters in length.

235 *

236 * This parameter is required.

237 *

238 * @example

239 * user_001

240 */

241 username?: string;

242

src/models/UpdateUserPasswordRequest.tsView file

Lines 38-78typescript

38 * @remarks

39 * The account ID.

40 *

41 * This parameter is required.

42 *

43 * @example

44 * user_d6sbsuumeta4h66ec3il7yxxxx

Source & flagged code

4 flagged · loading source

dist/models/CreateUserRequest.jsView file

99patternName = generic_password severity = medium line = 99 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/models/CreateUserRequest.jsView on unpkg · L99

dist/models/UpdateUserPasswordRequest.jsView file

43patternName = generic_password severity = medium line = 43 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in dist/models/UpdateUserPasswordRequest.js

dist/models/UpdateUserPasswordRequest.jsView on unpkg · L43

src/models/CreateUserRequest.tsView file

252patternName = generic_password severity = medium line = 252 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/models/CreateUserRequest.ts

src/models/CreateUserRequest.tsView on unpkg · L252

src/models/UpdateUserPasswordRequest.tsView file

58patternName = generic_password severity = medium line = 58 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/models/UpdateUserPasswordRequest.ts

src/models/UpdateUserPasswordRequest.tsView on unpkg · L58

Findings

4 Medium2 Low

MediumSecret Patterndist/models/CreateUserRequest.js

MediumSecret Patterndist/models/UpdateUserPasswordRequest.js

MediumSecret Patternsrc/models/CreateUserRequest.ts

MediumSecret Patternsrc/models/UpdateUserPasswordRequest.ts

LowNon Install Lifecycle Scripts

LowScripts Present

Source & flagged code

4 flagged

dist/models/CreateUserRequest.jsView file

Lines 79-119javascript

79 $dara.Model.validateArray(this.userNotificationChannels);

80 }

81 super.validate();

82 }

83 constructor(map) {

84 super(map);

85 }

86}

87exports.CreateUserRequestPasswordInitializationConfig = CreateUserRequestPasswordInitializationConfig;

88class CreateUserRequest extends $dara.Model {

89 static names() {

90 return {

91 clientToken: 'ClientToken',

92 customFields: 'CustomFields',

93 description: 'Description',

94 displayName: 'DisplayName',

95 email: 'Email',

96 emailVerified: 'EmailVerified',

97 instanceId: 'InstanceId',

98 organizationalUnitIds: 'OrganizationalUnitIds',

99 password: 'Password',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/models/CreateUserRequest.jsView on unpkg · L99

100 passwordInitializationConfig: 'PasswordInitializationConfig',

101 phoneNumber: 'PhoneNumber',

102 phoneNumberVerified: 'PhoneNumberVerified',

103 phoneRegion: 'PhoneRegion',

104 primaryOrganizationalUnitId: 'PrimaryOrganizationalUnitId',

105 userExternalId: 'UserExternalId',

106 username: 'Username',

107 };

108 }

109 static types() {

110 return {

111 clientToken: 'string',

112 customFields: { 'type': 'array', 'itemType': CreateUserRequestCustomFields },

113 description: 'string',

114 displayName: 'string',

115 email: 'string',

116 emailVerified: 'boolean',

117 instanceId: 'string',

118 organizationalUnitIds: { 'type': 'array', 'itemType': 'string' },

119 password: 'string',

dist/models/UpdateUserPasswordRequest.jsView file

Lines 23-63javascript

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var

src/models/CreateUserRequest.tsView file

Lines 232-272typescript

232 /**

233 * @remarks

234 * The username. The username can contain letters, digits, underscores (_), periods (.), at signs (@), and hyphens (-). The username can be up to 256 characters in length.

235 *

236 * This parameter is required.

237 *

238 * @example

239 * user_001

240 */

241 username?: string;

242

src/models/UpdateUserPasswordRequest.tsView file

Lines 38-78typescript

38 * @remarks

39 * The account ID.

40 *

41 * This parameter is required.

42 *

43 * @example

44 * user_d6sbsuumeta4h66ec3il7yxxxx