registry / Credential exfiltration / @bysking/b-code
@bysking/b-code
从零构建的编码助手 — 你自己的 B-Code，运行在终端里
This report shows the evidence for @bysking/b-code@1.0.3. 4 of 11 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe CLI entrypoint reaches first-run setup, which can pair an Anthropic key with the publisher-default DeepSeek endpoint and use that key in requests. This is concrete credential disclosure to an unrelated recipient, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
The CLI starts without settings, the user selects Anthropic, enters an Anthropic key, and accepts the default base URL.
Impact
The Anthropic key is disclosed to an unrelated, publisher-default service.
Mechanism
Setup persists the key and base URL; the Anthropic client then uses both to send streaming requests to the configured host.
Attack narrative
On first launch without settings, the CLI offers Anthropic as a backend but defaults the base URL to DeepSeek. If the user enters an Anthropic API key and keeps that default, startup saves the configuration and the Anthropic client sends requests using the key to the DeepSeek host.
AI rationale
The CLI entrypoint reaches first-run setup, which can pair an Anthropic key with the publisher-default DeepSeek endpoint and use that key in requests. This is concrete credential disclosure to an unrelated recipient, so the package should be blocked.
Evidence
package.jsondist/cli.mjssettings.json
Network endpoints1
api.deepseek.com
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json routes the CLI command to dist/cli.mjs.
- First-run setup lets the user choose Anthropic and enter an API key.
- Setup defaults the base URL to DeepSeek and accepts that displayed default when the user presses Enter.
- When no settings exist, startup runs setup and saves the entered configuration.
- The configuration loader maps an Anthropic key and base URL into Anthropic environment variables.
- The Anthropic client uses those variables to send streaming requests.
Evidence against
- Setup prompts for the backend, API key, and base URL; the base URL is also shown in its configuration summary.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flagged · loading sourcedist/cli.mjsView file
13${A}
L14: ${E}`)}return A},Z=U7(T2)});var _u,zw=ee(()=>{It();Ft();it();Ot();_u=class extends we{retrieve(e,r={},n){let{betas:i}=r??{};return this._client.get(Z`/v1/deployment_runs/${e}?beta=...
L15: `);return e[e.length-1]===""&&e.pop(),e}function kX(t,e){return/^[\x20-\x7E]+$/.test(e)&&!/[\\^#]/.test(e)&&!(t==="unzip"&&e.startsWith("-"))}function DX(t,e,r){let n=gM(e),i=gM(r)...
High
492Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(r):this._lifeCycleHooks[e]=[r],this}exitOverride(e){return e?this._exitCallback=e...
L493: - already used by option '${r.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let r=i=>[i.name()].concat(i.aliases()),n=r(e).find(i=>this._findCommand(...
L494: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...
High
5`);let n;for(;(n=PK.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let A=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),A==='"'&&(s=s.replace(/\\n/g,`
L6: `),s=s.replace(/\\r/g,"\r")),e[i]=s}return e}function WK(t){t=t||{};let e=I1(t);t.path=e;let r=$r.configDotenv(t);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${e} for...
L7: `):[]}};xi=new WeakMap,vi=new WeakMap;ja.NEWLINE_CHARS=new Set([`
...
L13: ${A}
L14: ${E}`)}return A},Z=U7(T2)});var _u,zw=ee(()=>{It();Ft();it();Ot();_u=class extends we{retrieve(e,r={},n){let{betas:i}=r??{};return this._client.get(Z`/v1/deployment_runs/${e}?beta=...
L15: `);return e[e.length-1]===""&&e.pop(),e}function kX(t,e){return/^[\x20-\x7E]+$/.test(e)&&!/[\\^#]/.test(e)&&!(t==="unzip"&&e.startsWith("-"))}function DX(t,e,r){let n=gM(e),i=
Findings
9 High3 Medium6 Low
HighChild Processdist/cli.mjs
HighShelldist/cli.mjs
HighSame File Env Network Executiondist/cli.mjs
HighCredential Redirect Persistencedist/cli.mjs
HighCommand Output Exfiltrationdist/cli.mjs
HighRemote Agent Bridgedist/cli.mjs
HighTrigger Reachable Command Output Exfiltrationdist/cli.mjs
HighKnown Malware Source Similaritydist/cli.mjs
HighKnown Malware Source Fingerprint Signaturedist/cli.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to @bysking/b-code@1.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing @bysking/b-code@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.