registry / @clawhelp/fmlhealth-cli / 1.0.8

@clawhelp/fmlhealth-cli@1.0.8

一家检 - 家庭健康管理命令行工具

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The CLI can collect a broad MCP_API_KEY environment variable during normal command execution and transmit it to the package service as a bearer token. It also stores that value under the user's home directory.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User or agent runs fmlhealth-cli commands that call request() without an existing saved token.

Impact

Potential exfiltration and persistence of a broad agent/API credential unrelated to this health CLI.

Mechanism

environment credential capture and bearer-token transmission

Attack narrative

On normal CLI use, getToken() falls back to process.env.YJ_API_KEY or process.env.MCP_API_KEY, saves the value to ~/.fmlhealth-cli/token.json, and request() sends it as an Authorization bearer token to www.fmlhealth.cn API paths. The MCP_API_KEY name is a broad agent credential name, not package-specific, and the included SKILL.md is designed for AI-agent invocation.

Rationale

Source inspection confirms concrete runtime credential capture of a broad MCP_API_KEY and transmission to the package's external service, not merely scanner noise. Lack of install hooks and package-aligned endpoints reduce AI-control-surface concerns but do not remove credential-exfiltration risk.

Evidence

package.jsonbin/fmlhealth-cli.jsSKILL.mdREADME.md~/.fmlhealth-cli/token.json

Network endpoints3

www.fmlhealth.cnwww.fmlhealth.cn/api/auth/oauth/cli-tokenwww.fmlhealth.cn/login.html

Decision evidence

public snapshot

AI called this Malicious at 82.0% confidence as Malware with low false-positive risk.

Evidence for block

bin/fmlhealth-cli.js reads process.env.MCP_API_KEY as an auth token fallback.
bin/fmlhealth-cli.js persists env token to ~/.fmlhealth-cli/token.json.
Most runtime commands send that token as Authorization Bearer to www.fmlhealth.cn.
SKILL.md targets AI agents, increasing likelihood a broad MCP_API_KEY exists in the runtime environment.

Evidence against

package.json has no npm lifecycle scripts.
child_process use only opens the package login URL in a browser during explicit auth login.
No code writes Claude/Codex/Cursor/MCP control-surface config files.
Network traffic is limited to package-aligned www.fmlhealth.cn endpoints.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 12.0 KB of source, external domains: www.fmlhealth.cn

Source & flagged code

3 flagged

bin/fmlhealth-cli.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * fmlhealth-cli — 一家检命令行工具

4 *

5 * 用法:

6 * fmlhealth-cli members — 列出家庭成员

7 * fmlhealth-cli health <name> — 健康摘要

8 * fmlhealth-cli tests <name> [indicator] — 自测记录

9 * fmlhealth-cli test-add <name> <indicator> <value> [diastolic] — 录入

10 * fmlhealth-cli test-delete <name> <indicator> [count] — 删除最近 N 条自测记录（默认 1 条）

11 * fmlhealth-cli trend <name> <indicator> — 趋势分析

12 * fmlhealth-cli checkin [name] — 打卡状态

13 * fmlhealth-cli analyze <name> — 健康分析

14 * fmlhealth-cli auth login — 授权登录（支付宝/微信）

15 * fmlhealth-cli +me — 查看当前登录身份

16 * fmlhealth-cli stats — 运营指标（管理员）

17 */

19'use strict';

21const http = require('https');

22const fs = require('fs');

23const path = require('path');

24const os = require('os');

26const BASE_URL = 'https://www.fmlhealth.cn';

27const CONFIG_DIR = path.join(os.homedir(), '.fmlhealth-cli');

28const TOKEN_FILE = path.join(CONFIG_DIR, 'token.json');

30function getSavedToken() {

31 try {

32 if (fs.existsSync(TOKEN_FILE)) {

33 return JSON.parse(fs.readFileSync(TOKEN_FILE, 'utf8')).token;

34 }

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

bin/fmlhealth-cli.jsView on unpkg · L20

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/fmlhealth-cli.jsView on unpkg · L20

35 } catch (_) {}

36 return null;

37}

39function saveToken(token) {

40 fs.mkdirSync(CONFIG_DIR, { recursive: true });

Lines 186-226javascript

186 name: a.name, value: a.value, unit: a.unit,

187 ref: `${a.ref_min || ''}~${a.ref_max || ''}`,

188 flag: a.value > a.ref_max ? '↑高' : a.value < a.ref_min ? '↓低'

Source & flagged code

3 flagged · loading source

bin/fmlhealth-cli.jsView file

20L21: const http = require('https'); L22: const fs = require('fs'); ... L26: const BASE_URL = 'https://www.fmlhealth.cn'; L27: const CONFIG_DIR = path.join(os.homedir(), '.fmlhealth-cli'); L28: const TOKEN_FILE = path.join(CONFIG_DIR, 'token.json'); ... L32: if (fs.existsSync(TOKEN_FILE)) { L33: return JSON.parse(fs.readFileSync(TOKEN_FILE, 'utf8')).token; L34: } ... L46: if (saved) return saved; L47: const env = process.env.YJ_API_KEY || process.env.MCP_API_KEY L48: if (env) { saveToken(env); return env; }

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

bin/fmlhealth-cli.jsView on unpkg · L20

20Trigger-reachable chain: manifest.bin -> bin/fmlhealth-cli.js L20: L21: const http = require('https'); L22: const fs = require('fs'); ... L26: const BASE_URL = 'https://www.fmlhealth.cn'; L27: const CONFIG_DIR = path.join(os.homedir(), '.fmlhealth-cli'); L28: const TOKEN_FILE = path.join(CONFIG_DIR, 'token.json'); ... L32: if (fs.existsSync(TOKEN_FILE)) { L33: return JSON.parse(fs.readFileSync(TOKEN_FILE, 'utf8')).token; L34: } ... L46: if (saved) return saved; L47: const env = process.env.YJ_API_KEY || process.env.MCP_API_KEY L48: if (env) { saveToken(env); return env; }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/fmlhealth-cli.jsView on unpkg · L20

206const plat = require('os').platform(); L207: if (plat === 'darwin') require('child_process').execSync('open "' + loginUrl + '"'); L208: else if (plat === 'win32') require('child_process').execSync('start "" "' + loginUrl + '"');

High

Child Process

Package source references child process execution.

bin/fmlhealth-cli.jsView on unpkg · L206

Findings

2 Critical2 High3 Medium4 Low

CriticalCommand Output Exfiltrationbin/fmlhealth-cli.js

CriticalTrigger Reachable Dangerous Capabilitybin/fmlhealth-cli.js

HighChild Processbin/fmlhealth-cli.js

HighShell

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

bin/fmlhealth-cli.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * fmlhealth-cli — 一家检命令行工具

4 *

5 * 用法:

6 * fmlhealth-cli members — 列出家庭成员

7 * fmlhealth-cli health <name> — 健康摘要

8 * fmlhealth-cli tests <name> [indicator] — 自测记录

9 * fmlhealth-cli test-add <name> <indicator> <value> [diastolic] — 录入

10 * fmlhealth-cli test-delete <name> <indicator> [count] — 删除最近 N 条自测记录（默认 1 条）

11 * fmlhealth-cli trend <name> <indicator> — 趋势分析

12 * fmlhealth-cli checkin [name] — 打卡状态

13 * fmlhealth-cli analyze <name> — 健康分析

14 * fmlhealth-cli auth login — 授权登录（支付宝/微信）

15 * fmlhealth-cli +me — 查看当前登录身份

16 * fmlhealth-cli stats — 运营指标（管理员）

17 */

19'use strict';

21const http = require('https');

22const fs = require('fs');

23const path = require('path');

24const os = require('os');

26const BASE_URL = 'https://www.fmlhealth.cn';

27const CONFIG_DIR = path.join(os.homedir(), '.fmlhealth-cli');

28const TOKEN_FILE = path.join(CONFIG_DIR, 'token.json');

30function getSavedToken() {

31 try {

32 if (fs.existsSync(TOKEN_FILE)) {

33 return JSON.parse(fs.readFileSync(TOKEN_FILE, 'utf8')).token;

34 }

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

bin/fmlhealth-cli.jsView on unpkg · L20

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/fmlhealth-cli.jsView on unpkg · L20

35 } catch (_) {}

36 return null;

37}

39function saveToken(token) {

40 fs.mkdirSync(CONFIG_DIR, { recursive: true });

Lines 186-226javascript

186 name: a.name, value: a.value, unit: a.unit,

187 ref: `${a.ref_min || ''}~${a.ref_max || ''}`,

188 flag: a.value > a.ref_max ? '↑高' : a.value < a.ref_min ? '↓低'