@bysking/b-code@0.1.6

从零构建的编码助手 — 你自己的 B-Code，运行在终端里

AI Security Review

scanned 17d ago · by lpm-firewall-ai

Source inspection ties the flagged network, credential, and command behavior to the interactive coding assistant, including endpoint selection and default tool confirmation. The indicated agent integration reads project instructions rather than modifying another agent's control surface.

Static reason

One or more suspicious static signals were detected.

Trigger

Launching the CLI activates setup and interactive assistant operation; registry installation has no automatic lifecycle trigger.

Impact

The inspected behavior supports the assistant's function; no covert credential export or foreign agent configuration mutation was established.

Mechanism

Project instructions and tool results enter model context, requests use the configured provider, and settings are saved in the package-owned configuration directory.

AI rationale

Evidence

.b-codesettings.jsonCLAUDE.md

Network endpoints1

api.deepseek.com

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no install lifecycle hooks or runtime self-dependency; prepublishOnly builds and typechecks.
The flagged location reads CLAUDE.md files and includes into model context during chat; it does not mutate agent configuration.
Interactive setup asks for an API key and base URL, allowing credentials supplied for the selected endpoint.
Settings default to the package's own settings.json location, with an environment override.
Local shell and write tools require confirmation in default mode; accepted permissions are remembered for the session.
Conversation context and tool results are sent to the configured model endpoint as part of the coding assistant workflow.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Source & flagged code

7 flagged

dist/cli.mjsView file

13${A} L14: ${E}`)}return A},Z=Kj(C2)});var Du,Fw=$(()=>{Bt();Ft();nt();Ot();Du=class extends we{retrieve(e,r={},n){let{betas:i}=r??{};return this._client.get(Z`/v1/deployment_runs/${e}?beta=t... L15: `);return e[e.length-1]===""&&e.pop(),e}function U7(t,e){return/^[\x20-\x7E]+$/.test(e)&&!/[\\^#]/.test(e)&&!(t==="unzip"&&e.startsWith("-"))}function L7(t,e,r){let n=X2(e),i=X2(r)...

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L13

5`);let n;for(;(n=ij.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let A=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),A==='"'&&(s=s.replace(/\\n/g,` L6: `),s=s.replace(/\\r/g,"\r")),e[i]=s}return e}function aj(t){t=t||{};let e=i1(t);t.path=e;let r=Zr.configDotenv(t);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${e} for... L7: `):[]}};xi=new WeakMap,vi=new WeakMap;Pa.NEWLINE_CHARS=new Set([` ... L13: ${A} L14: ${E}`)}return A},Z=Kj(C2)});var Du,Fw=$(()=>{Bt();Ft();nt();Ot();Du=class extends we{retrieve(e,r={},n){let{betas:i}=r??{};return this._client.get(Z`/v1/deployment_runs/${e}?beta=t... L15: `);return e[e.length-1]===""&&e.pop(),e}function U7(t,e){return/^[\x20-\x7E]+$/.test(e)&&!/[\\^#]/.test(e)&&!(t==="unzip"&&e.startsWith("-"))}function L7(t,e,r){let n=X2(e),i=

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L5

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: `),s=s.replace(/\\r/g,"\r")),e[i]=s}return e}function aj(t){t=t||{};let e=i1(t);t.path=e;let r=Zr.configDotenv(t);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${e} for... ${E}`)}return A},Z=Kj(C2)});var Du,Fw=$(()=>{Bt();Ft();nt();Ot();Du=class extends we{retrieve(e,r={},n){let{betas:i}=r??{};return this._client.get(Z`/v1/deployment_runs/${e}?beta=t... `);return e[e.length-1]===""&&e.pop(),e}function U7(t,e){return/^[\x20-\x7E]+$/.test(e)&&!/[\\^#]/.test(e)&&!(t==="unzip"&&e.startsWith("-"))}function L7(t,e,r){let n=X2(e),i=X2(r)... `,{flag:"wx",mode:384}),["-xf",e,"-C",r,"-X",i])}async function H7(t,e){let r

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

3const require = __bcodeCreateRequire(import.meta.url); L4: var VK=Object.create;var ew=Object.defineProperty;var WK=Object.getOwnPropertyDescriptor;var KK=Object.getOwnPropertyNames;var jK=Object.getPrototypeOf,XK=Object.prototype.hasOwnPr... L5: `);let n;for(;(n=ij.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let A=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),A==='"'&&(s=s.replace(/\\n/g,` L6: `),s=s.replace(/\\r/g,"\r")),e[i]=s}return e}function aj(t){t=t||{};let e=i1(t);t.path=e;let r=Zr.configDotenv(t);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${e} for... L7: `):[]}};xi=new WeakMap,vi=new WeakMap;Pa.NEWLINE_CHARS=new Set([` ... L13: ${A} L14: ${E}`)}return A},Z=Kj(C2)});var Du,Fw=$(()=>{Bt();Ft();nt();Ot();Du=class extends we{retrieve(e,r={},n){let{betas:i}=

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L3

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.mjsView on unpkg · L5

3Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.mjs L3: const require = __bcodeCreateRequire(import.meta.url); L4: var VK=Object.create;var ew=Object.defineProperty;var WK=Object.getOwnPropertyDescriptor;var KK=Object.getOwnPropertyNames;var jK=Object.getPrototypeOf,XK=Object.prototype.hasOwnPr... L5: `);let n;for(;(n=ij.exec(r))!=null;){let i=n[1],s=n[2]||"";s=s.trim();let A=s[0];s=s.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),A==='"'&&(s=s.replace(/\\n/g,` L6: `),s=s.replace(/\\r/g,"\r")),e[i]=s}return e}function aj(t){t=t||{};let e=i1(t);t.path=e;let r=Zr.configDotenv(t);if(!r.parsed){let A=new Error(`MISSING_DATA: Cannot parse ${e} for... L7: `):[]}};xi=new WeakMap,vi=new WeakMap;Pa.NEWLINE_CHARS=new Set([` ... L13: ${A} L14: ${E}`)}return A},Z=Kj(C2)});var Du

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.mjsView on unpkg · L3

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L3

Source & flagged code

7 flagged · loading source

dist/cli.mjsView file

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L13

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L5

Findings

6 High3 Medium6 Low

HighChild Processdist/cli.mjs

HighSame File Env Network Executiondist/cli.mjs

HighCredential Redirect Persistencedist/cli.mjs

HighCommand Output Exfiltrationdist/cli.mjs

HighRemote Agent Bridgedist/cli.mjs

HighTrigger Reachable Command Output Exfiltrationdist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @bysking/b-code@0.1.6.

See all versions of @bysking/b-code for other recorded verdicts.

Review the evidence and your use of @bysking/b-code@0.1.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-06 09:46:51.323Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.