registry / @aliyun-meoo/cli / 0.3.2

@aliyun-meoo/cli@0.3.2

Meoo 平台命令行工具 — 管理项目、云服务、边缘函数和部署

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 175 file(s), 505 KB of source, external domains: api.weixin.qq.com, docs.meoo.com, esm.sh, img.alicdn.com, meoo.com, registry.npmjs.org, registry.npmmirror.com

Source & flagged code

6 flagged

dist/commands/cloud/enable-register-login.jsView file

Lines 1-39javascript

1"use strict";

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

4 if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;

6 return c > 3 && r && Object.defineProperty(target, key, r), r;

7};

8var __importDefault = (this && this.__importDefault) || function (mod) {

9 return (mod && mod.__esModule) ? mod : { "default": mod };

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.CloudEnableRegisterLoginCommand = void 0;

13const chalk_1 = __importDefault(require("chalk"));

14const common_1 = require("../common");

15const apiClient_1 = require("../../lib/apiClient");

16const projectConfig_1 = require("../../lib/projectConfig");

17const output_1 = require("../../lib/output");

18const VALID_PROVIDERS = new Set(['password', 'email', 'sms']);

19const PROVIDER_ALIASES = { account_password: 'password', phone: 'sms' };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/cloud/enable-register-login.jsView on unpkg · L19

20const CANONICAL_ORDER = ['password', 'email', 'sms'];

21const PROVIDER_LABELS = {

22 password: '用户名密码',

23 email: '邮箱验证码 + 密码',

24 sms: '短信验证码 + 密码',

25};

26function normalizeProviders(input) {

27 const raw = input.split(',').map(s => s.trim().toLowerCase()).filter(Boolean);

28 if (!raw.length)

29 throw new Error('--providers 不能为空');

30 const mapped = raw.map(p => PROVIDER_ALIASES[p] || p);

31 const invalid = mapped.filter(p => !VALID_PROVIDERS.has(p));

32 if (invalid.length) {

33 throw new Error(`不支持的认证方式: ${invalid.join(', ')}，仅支持 password、email、sms`);

34 }

35 const set = new Set(mapped);

36 return CANONICAL_ORDER.filter(p => set.has(p));

37}

38function extractAuthError(res) {

39 if (res.success === false) {

dist/commands/login.jsView file

Lines 26-66javascript

26 ownKeys = Object.getOwnPropertyNames || function (o) {

27 var ar = [];

28 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

templates/go-app/scripts/setup.shView file

•path = templates/go-app/scripts/setup.sh kind = build_helper sizeBytes = 82 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/go-app/scripts/setup.shView on unpkg

dist/commands/deploy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aliyun-meoo/cli@0.2.9 matchedIdentity = npm:QGFsaXl1bi1tZW9vL2NsaQ:0.2.9 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/deploy.jsView on unpkg

skills/meoo-cli/references/cloud-patterns.mdView file

Lines 201-247markdown

201 if (line.startsWith('data: ') && line !== 'data: [DONE]') {

202 try {

203 const json = JSON.parse(line.slice(6));

204 const content = json.choices?.[0]?.delta?.content;

205 if (content) onChunk(content);

206 } catch {}

207 }

208 }

209 }

210}

211```

212

Source & flagged code

6 flagged · loading source

dist/commands/cloud/enable-register-login.jsView file

19patternName = generic_password severity = medium line = 19 matchedText = const PR...' };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/cloud/enable-register-login.jsView on unpkg · L19

dist/commands/login.jsView file

46const chalk_1 = __importDefault(require("chalk")); L47: const child_process_1 = require("child_process"); L48: const os = __importStar(require("os")); ... L59: function openBrowser(url) { L60: const cmd = process.platform === 'darwin' L61: ? `open "${url}"` ... L75: console.log(chalk_1.default.dim(' │ │')); L76: console.log(chalk_1.default.dim(' │ 1. 打开 Meoo 平台 ') + chalk_1.default.cyan('https://meoo.com') + chalk_1.default.dim(' │')); L77: console.log(chalk_1.default.dim(' │ │')); ... L153: // 1. 创建登录会话（带设备信息，供授权页展示） L154: const sessionRes = await client.post('/api/v1/cli/auth/session', { L155: deviceName: os.hostname(),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/login.jsView on unpkg · L46

templates/go-app/scripts/setup.shView file

•path = templates/go-app/scripts/setup.sh kind = build_helper sizeBytes = 82 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/go-app/scripts/setup.shView on unpkg

dist/commands/deploy.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/deploy.jsView on unpkg

skills/meoo-cli/references/cloud-patterns.mdView file

221patternName = generic_password severity = medium line = 221 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/meoo-cli/references/cloud-patterns.md

skills/meoo-cli/references/cloud-patterns.mdView on unpkg · L221

227patternName = generic_password severity = medium line = 227 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/meoo-cli/references/cloud-patterns.md

skills/meoo-cli/references/cloud-patterns.mdView on unpkg · L227

Findings

2 High7 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/commands/login.js

HighPrevious Version Dangerous Deltadist/commands/deploy.js

MediumSecret Patterndist/commands/cloud/enable-register-login.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/go-app/scripts/setup.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/meoo-cli/references/cloud-patterns.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/commands/cloud/enable-register-login.jsView file

Lines 1-39javascript

1"use strict";

2var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {

3 var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;

4 if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

5 else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;

6 return c > 3 && r && Object.defineProperty(target, key, r), r;

7};

8var __importDefault = (this && this.__importDefault) || function (mod) {

9 return (mod && mod.__esModule) ? mod : { "default": mod };

10};

11Object.defineProperty(exports, "__esModule", { value: true });

12exports.CloudEnableRegisterLoginCommand = void 0;

13const chalk_1 = __importDefault(require("chalk"));

14const common_1 = require("../common");

15const apiClient_1 = require("../../lib/apiClient");

16const projectConfig_1 = require("../../lib/projectConfig");

17const output_1 = require("../../lib/output");

18const VALID_PROVIDERS = new Set(['password', 'email', 'sms']);

19const PROVIDER_ALIASES = { account_password: 'password', phone: 'sms' };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/cloud/enable-register-login.jsView on unpkg · L19

20const CANONICAL_ORDER = ['password', 'email', 'sms'];

21const PROVIDER_LABELS = {

22 password: '用户名密码',

23 email: '邮箱验证码 + 密码',

24 sms: '短信验证码 + 密码',

25};

26function normalizeProviders(input) {

27 const raw = input.split(',').map(s => s.trim().toLowerCase()).filter(Boolean);

28 if (!raw.length)

29 throw new Error('--providers 不能为空');

30 const mapped = raw.map(p => PROVIDER_ALIASES[p] || p);

31 const invalid = mapped.filter(p => !VALID_PROVIDERS.has(p));

32 if (invalid.length) {

33 throw new Error(`不支持的认证方式: ${invalid.join(', ')}，仅支持 password、email、sms`);

34 }

35 const set = new Set(mapped);

36 return CANONICAL_ORDER.filter(p => set.has(p));

37}

38function extractAuthError(res) {

39 if (res.success === false) {

dist/commands/login.jsView file

Lines 26-66javascript

26 ownKeys = Object.getOwnPropertyNames || function (o) {

27 var ar = [];

28 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

templates/go-app/scripts/setup.shView file

•path = templates/go-app/scripts/setup.sh kind = build_helper sizeBytes = 82 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/go-app/scripts/setup.shView on unpkg

dist/commands/deploy.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/deploy.jsView on unpkg

skills/meoo-cli/references/cloud-patterns.mdView file

Lines 201-247markdown

201 if (line.startsWith('data: ') && line !== 'data: [DONE]') {

202 try {

203 const json = JSON.parse(line.slice(6));

204 const content = json.choices?.[0]?.delta?.content;

205 if (content) onChunk(content);

206 } catch {}

207 }

208 }

209 }

210}

211```

212