registry / @aliyun-meoo/cli / 0.2.9

@aliyun-meoo/cli@0.2.9

Meoo 平台命令行工具 — 管理项目、云服务、边缘函数和部署

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 161 file(s), 484 KB of source, external domains: api.weixin.qq.com, docs.meoo.com, esm.sh, img.alicdn.com, meoo.com, registry.npmjs.org, registry.npmmirror.com

Source & flagged code

4 flagged

dist/commands/cloud/enable-register-login.jsView file

Lines 1-39javascript

1"use strict";

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

4 if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;

6 return c > 3 && r && Object.defineProperty(target, key, r), r;

7};

8var __importDefault = (this && this.__importDefault) || function (mod) {

9 return (mod && mod.__esModule) ? mod : { "default": mod };

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.CloudEnableRegisterLoginCommand = void 0;

13const chalk_1 = __importDefault(require("chalk"));

14const common_1 = require("../common");

15const apiClient_1 = require("../../lib/apiClient");

16const projectConfig_1 = require("../../lib/projectConfig");

17const output_1 = require("../../lib/output");

18const VALID_PROVIDERS = new Set(['password', 'email', 'sms']);

19const PROVIDER_ALIASES = { account_password: 'password', phone: 'sms' };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/cloud/enable-register-login.jsView on unpkg · L19

20const CANONICAL_ORDER = ['password', 'email', 'sms'];

21const PROVIDER_LABELS = {

22 password: '用户名密码',

23 email: '邮箱验证码 + 密码',

24 sms: '短信验证码 + 密码',

25};

26function normalizeProviders(input) {

27 const raw = input.split(',').map(s => s.trim().toLowerCase()).filter(Boolean);

28 if (!raw.length)

29 throw new Error('--providers 不能为空');

30 const mapped = raw.map(p => PROVIDER_ALIASES[p] || p);

31 const invalid = mapped.filter(p => !VALID_PROVIDERS.has(p));

32 if (invalid.length) {

33 throw new Error(`不支持的认证方式: ${invalid.join(', ')}，仅支持 password、email、sms`);

34 }

35 const set = new Set(mapped);

36 return CANONICAL_ORDER.filter(p => set.has(p));

37}

38function extractAuthError(res) {

39 if (res.success === false) {

dist/commands/login.jsView file

Lines 26-66javascript

26 ownKeys = Object.getOwnPropertyNames || function (o) {

27 var ar = [];

28 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

skills/meoo-cli/references/cloud-patterns.mdView file

Lines 163-209markdown

163 if (line.startsWith('data: ') && line !== 'data: [DONE]') {

164 try {

165 const json = JSON.parse(line.slice(6));

166 const content = json.choices?.[0]?.delta?.content;

167 if (content) onChunk(content);

168 } catch {}

169 }

170 }

171 }

172}

173```

174

Source & flagged code

4 flagged · loading source

dist/commands/cloud/enable-register-login.jsView file

19patternName = generic_password severity = medium line = 19 matchedText = const PR...' };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/cloud/enable-register-login.jsView on unpkg · L19

dist/commands/login.jsView file

46const chalk_1 = __importDefault(require("chalk")); L47: const child_process_1 = require("child_process"); L48: const os = __importStar(require("os")); ... L59: function openBrowser(url) { L60: const cmd = process.platform === 'darwin' L61: ? `open "${url}"` ... L75: console.log(chalk_1.default.dim(' │ │')); L76: console.log(chalk_1.default.dim(' │ 1. 打开 Meoo 平台 ') + chalk_1.default.cyan('https://meoo.com') + chalk_1.default.dim(' │')); L77: console.log(chalk_1.default.dim(' │ │')); ... L153: // 1. 创建登录会话（带设备信息，供授权页展示） L154: const sessionRes = await client.post('/api/v1/cli/auth/session', { L155: deviceName: os.hostname(),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/login.jsView on unpkg · L46

skills/meoo-cli/references/cloud-patterns.mdView file

183patternName = generic_password severity = medium line = 183 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/meoo-cli/references/cloud-patterns.md

skills/meoo-cli/references/cloud-patterns.mdView on unpkg · L183

189patternName = generic_password severity = medium line = 189 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/meoo-cli/references/cloud-patterns.md

skills/meoo-cli/references/cloud-patterns.mdView on unpkg · L189

Findings

1 High6 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/commands/login.js

MediumSecret Patterndist/commands/cloud/enable-register-login.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/meoo-cli/references/cloud-patterns.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/commands/cloud/enable-register-login.jsView file

Lines 1-39javascript

1"use strict";

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

4 if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;

6 return c > 3 && r && Object.defineProperty(target, key, r), r;

7};

8var __importDefault = (this && this.__importDefault) || function (mod) {

9 return (mod && mod.__esModule) ? mod : { "default": mod };

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.CloudEnableRegisterLoginCommand = void 0;

13const chalk_1 = __importDefault(require("chalk"));

14const common_1 = require("../common");

15const apiClient_1 = require("../../lib/apiClient");

16const projectConfig_1 = require("../../lib/projectConfig");

17const output_1 = require("../../lib/output");

18const VALID_PROVIDERS = new Set(['password', 'email', 'sms']);

19const PROVIDER_ALIASES = { account_password: 'password', phone: 'sms' };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/cloud/enable-register-login.jsView on unpkg · L19

20const CANONICAL_ORDER = ['password', 'email', 'sms'];

21const PROVIDER_LABELS = {

22 password: '用户名密码',

23 email: '邮箱验证码 + 密码',

24 sms: '短信验证码 + 密码',

25};

26function normalizeProviders(input) {

27 const raw = input.split(',').map(s => s.trim().toLowerCase()).filter(Boolean);

28 if (!raw.length)

29 throw new Error('--providers 不能为空');

30 const mapped = raw.map(p => PROVIDER_ALIASES[p] || p);

31 const invalid = mapped.filter(p => !VALID_PROVIDERS.has(p));

32 if (invalid.length) {

33 throw new Error(`不支持的认证方式: ${invalid.join(', ')}，仅支持 password、email、sms`);

34 }

35 const set = new Set(mapped);

36 return CANONICAL_ORDER.filter(p => set.has(p));

37}

38function extractAuthError(res) {

39 if (res.success === false) {

dist/commands/login.jsView file

Lines 26-66javascript

26 ownKeys = Object.getOwnPropertyNames || function (o) {

27 var ar = [];

28 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

skills/meoo-cli/references/cloud-patterns.mdView file

Lines 163-209markdown

163 if (line.startsWith('data: ') && line !== 'data: [DONE]') {

164 try {

165 const json = JSON.parse(line.slice(6));

166 const content = json.choices?.[0]?.delta?.content;

167 if (content) onChunk(content);

168 } catch {}

169 }

170 }

171 }

172}

173```

174