Loading npm security reports…

@alipay/agent-payment@1.0.18: Suspicious npm security report | LPM Firewall

registry / @alipay/agent-payment / 1.0.18

@alipay/agent-payment@1.0.18

⚠ Under review

Helper scripts for managing alipay-bot-cli and openclaw plugin

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 2 file(s), 361 KB of source, external domains: collect.alipay.com, docs.payguard.com, mdn.alipayobjects.com

Source & flagged code

6 flagged

bin/install-payguard.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * PayGuard 自动安装脚本

4 * 在第三方 CLI 的 npm install 阶段执行

5 *

6 * 功能：

7 * 1. 检测 PayGuard 是否已安装且运行

8 * 2. 未安装时从 CDN 获取最新版本并下载

9 * 3. 执行用户级静默安装

10 */

12const fs = require('fs');

13const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/install-payguard.jsView on unpkg · L11

14const https = require('https');

15const { execSync, execFileSync } = require('child_process');

16const os = require('os');

High

Child Process

Package source references child process execution.

bin/install-payguard.jsView on unpkg · L14

17const crypto = require('crypto');

18const zlib = require('zlib');

20// 配置

21const CONFIG = {

22 // 版本元数据 API 基地址

23 metaUrlBase: 'https://mdn.alipayobjects.com/apg_afts/uri/file/as',

24 // 用户级安装目录

25 installDir: {

26 linux: process.env.PAYGUARD_INSTALL_DIR || path.join(os.homedir(), '.payguard'),

27 darwin: process.env.PAYGUARD_INSTALL_DIR || path.join(os.homedir(), 'Library/Application Support/com.alipay.agent.payguard/PayGuard.app'),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/install-payguard.jsView on unpkg · L13

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/install-payguard.jsView on unpkg · L13

28 win32: process.env.PAYGUARD_INSTALL_DIR || path.join(os.homedir(), 'AppData/Roaming/PayGuard')

29 },

30 // 系统级安装目录（root/管理员安装）

31 systemInstallDir: {

32 linux: '/opt/PayGuard',

33 darwin: '/Library/Application Support/com.alipay.agent.payguard/PayGuard.app',

34 win32: 'C:\\Program Files\\Ant Group\\PayGuard'

dist/cli.jsView file

Lines 1-3javascript

1#!/usr/bin/env node

2'use strict';const _0x18c6ae=_0x44f1;(function(_0x23aec3,_0x3829d6){const _0x5c26d5=_0x44f1,_0x494e2a=_0x23aec3();while(!![]){

Source & flagged code

6 flagged · loading source

bin/install-payguard.jsView file

Source & flagged code

6 flagged

bin/install-payguard.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * PayGuard 自动安装脚本

4 * 在第三方 CLI 的 npm install 阶段执行

5 *

6 * 功能：

7 * 1. 检测 PayGuard 是否已安装且运行

8 * 2. 未安装时从 CDN 获取最新版本并下载

9 * 3. 执行用户级静默安装

10 */

12const fs = require('fs');

13const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/install-payguard.jsView on unpkg · L11

14const https = require('https');

15const { execSync, execFileSync } = require('child_process');

16const os = require('os');

High

Child Process

Package source references child process execution.

bin/install-payguard.jsView on unpkg · L14

17const crypto = require('crypto');

18const zlib = require('zlib');

20// 配置

21const CONFIG = {

22 // 版本元数据 API 基地址

23 metaUrlBase: 'https://mdn.alipayobjects.com/apg_afts/uri/file/as',

24 // 用户级安装目录

25 installDir: {

26 linux: process.env.PAYGUARD_INSTALL_DIR || path.join(os.homedir(), '.payguard'),

27 darwin: process.env.PAYGUARD_INSTALL_DIR || path.join(os.homedir(), 'Library/Application Support/com.alipay.agent.payguard/PayGuard.app'),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/install-payguard.jsView on unpkg · L13

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/install-payguard.jsView on unpkg · L13

28 win32: process.env.PAYGUARD_INSTALL_DIR || path.join(os.homedir(), 'AppData/Roaming/PayGuard')

29 },

30 // 系统级安装目录（root/管理员安装）

31 systemInstallDir: {

32 linux: '/opt/PayGuard',

33 darwin: '/Library/Application Support/com.alipay.agent.payguard/PayGuard.app',

34 win32: 'C:\\Program Files\\Ant Group\\PayGuard'

dist/cli.jsView file

Lines 1-3javascript

1#!/usr/bin/env node

2'use strict';const _0x18c6ae=_0x44f1;(function(_0x23aec3,_0x3829d6){const _0x5c26d5=_0x44f1,_0x494e2a=_0x23aec3();while(!![]){

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code