registry / AI-agent capability abuse / @deepseekcode/cli / 1.0.26

@deepseekcode/cli@1.0.26

已废弃：请使用 @deepseekcode/cli@1.0.37。

DeepSeekCode TypeScript CLI

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is not malware by the inspected evidence, but it is a high-impact agent runtime that can execute approved shell commands. The static critical labels for remote evaluation and credential exfiltration were not substantiated by source inspection.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs the CLI and authorizes an agent tool or PowerShell command.

Impact

Authorized commands can modify the user's workspace or system.

Mechanism

An AI-agent CLI executes approved shell commands.

AI rationale

Evidence

dist/cli.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The published command entrypoint is dist/cli.js and exposes an autonomous sub-agent with bash access.
The CLI includes a high-risk PowerShell command executor, although it requires approval.
The manifest has no install, preinstall, or postinstall hook; its only lifecycle-like script is prepublishOnly.

Evidence against

No remote-response evaluation sink was found: there is no eval or new Function occurrence in dist/cli.js.
No automatic install-time execution, self-dependency, or credential-export path was established.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 1.92 MB of source, external domains: api.example.com, api.github.com, cdn.jsdelivr.net, example.com, gh-proxy.com, ghfast.top, github.com, ilinkai.weixin.qq.com, mcp.example.com, mirror.ghproxy.com, raw.githubusercontent.com, react.dev, www.python.org, www.w3.org

Source & flagged code

18 flagged

dist/cli.jsView file

1#!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as nk8}from"node:module";var hk8=Object.create;var gk8=Object.getPrototypeOf;var Lw=Object.defineProperty;var uk8=Object.getOwnPropertyNames;var mk8=Object.pro... L9: at`)?" (<anonymous>)":-1<F.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L1

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.jsView on unpkg · L1

1Trigger-reachable chain: scripts.start -> dist/cli.js L1: #!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as nk8}from"node:module";var hk8=Object.create;var gk8=Object.getPrototypeOf;var Lw=Object.defineProperty;var uk8=Object.getOwnPropertyNames;var mk8=Object.pro... L9: at`)?" (<anonymous>)":-1<F.stack.indexOf("@")?"@unknown:0:0":""}return` ... L14: Error generating stack: `+R.message+` L15: `+R.stack}}function n(O,j){if(typeof

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @deepseekcode/cli@1.0.37 matchedIdentity = npm:QGRlZXBzZWVrY29kZS9jbGk:1.0.37 similarity = 0.364 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `;return""}bI.dump=_8;return bI}function Xi8(){if(C58)return D5;C58=1;const J=Ji8();const z=zi8();function X(Y,K){return function(){throw new Error("Function yaml."+Y+" is removed ... ${z.slice(0,200)}`}return z.slice(0,200)||null}if(z&&z.length>0){return z.length>200?`${z.slice(0,200)}...`:z}return null}var g3,e48,u3;var YJ8=X8(()=>{g3={plan:{label:"Plan",accen... `)return J+"\\n";if(X==="\r")return J+"\\r"}return null}function rN(J){if(!J||typeof J!=="string")return J;let z=J;if(Kk(z)){z=OY8(z)}if(z.startsWith('"')&&z.endsWith('"')){z=z.sli... [truncated]`:Y,path:this.relative(X),size:p86(X).size,truncated:K}}fileTree(J=

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

89L90: [truncated]`:Y,path:this.relative(X),size:p86(X).size,truncated:K}}fileTree(J=".",z=2,X=200){const Y=this.resolve(J);let K=0;const D=(Z,G)=>{K+=1;const q=g86(Z);const V=this.relati... L91: })`,{filename:"workflow-script.js"});const D=K.runInContext(Y,{timeout:1000});const Z=await D(X);if(!Z){return W$({title:z.message||"Workflow",description:z.message||"Workflow",goa... ... L101: L102: `)}`}return K}resolvePrimitivePrompt(J,z,X){const Y=this.definitions.get(X.workflowId);if(!Y)return J;const K=J.input&&typeof J.input==="object"?J.input:{};const D=String(K.prompt|... L103: `)} L104: `}function Qk(J){if(J==="passed")return"通过";if(J==="failed")return"失败";if(J==="blocked")return"阻塞";return J}function DM(J){return J.replace(/\|/g,"\\|").replace(/\n/g," ")}var $k,f... L105: `)}}var X

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L89

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

2if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L52: `+w.slice(q8+1)}else{E8+=w.slice(J8)}return E8.slice(1)}function $6(w){let d="";let D8=0;for(let z8=0;z8<w.length;D8>=65536?z8+=2:z8++){D8=x6(w,z8);const J8=x[D8];if(!J8&&c(D8)){d+... L53: `;return""}bI.dump=_8;return bI}function Xi8(){if(C58)return D5;C58=1;const J=Ji8();const z=zi8();function X(Y,K){return function(){throw new Error("Function yaml."+Y+" is removed ... L54: ${z.slice(0,200)}`}return z.slice(0,200)||null}if(z&&z.length>0){return

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.jsView on unpkg · L2

1Trigger-reachable credential exfiltration chain: scripts.start -> dist/cli.js L1: #!/usr/bin/env node L2: if(!process.env.DSC_NODE_ENV){process.env.DSC_NODE_ENV='1';process.env.NODE_ENV='production';} L3: if(!process.execArgv.some(a=>a.includes('max-old-space-size'))&&!process.env.NODE_OPTIONS?.includes('max-old-space-size')&&!process.env.DSC_RELAUNCHED){process.env.DSC_RELAUNCHED='... L4: import { createRequire as __clsCr } from 'module'; ... L7: __clsInitRequire(); L8: import{createRequire as nk8}from"node:module";var hk8=Object.create;var gk8=Object.getPrototypeOf;var Lw=Object.defineProperty;var uk8=Object.getOwnPropertyNames;var mk8=Object.pro... L9: at`)?" (<anonymous>)":-1<F.stack.indexOf("@")?"@unknown:0:0":""}return` ... L14: Error generating stack: `+R.message+` L15: `+R.stack}}f

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.jsView on unpkg · L1

89Trigger-reachable command-output exfiltration chain: scripts.start -> dist/cli.js L89: L90: [truncated]`:Y,path:this.relative(X),size:p86(X).size,truncated:K}}fileTree(J=".",z=2,X=200){const Y=this.resolve(J);let K=0;const D=(Z,G)=>{K+=1;const q=g86(Z);const V=this.relati... L91: })`,{filename:"workflow-script.js"});const D=K.runInContext(Y,{timeout:1000});const Z=await D(X);if(!Z){return W$({title:z.message||"Workflow",description:z.message||"Workflow",goa... ... L101: L102: `)}`}return K}resolvePrimitivePrompt(J,z,X){const Y=this.definitions.get(X.workflowId);if(!Y)return J;const K=J.input&&typeof J.input==="object"?J.input:{};const D=String(K.prompt|... L103: `)} L104: `}function Qk(J){if(J==="passed")return"通过";if(J==="failed")return"失败";if(J==="blocked")return"阻塞";return J}function

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L89

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @deepseekcode/cli@1.0.23 matchedPath = dist/cli.js matchedIdentity = npm:QGRlZXBzZWVrY29kZS9jbGk:1.0.23 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L2

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli.jsView on unpkg · L1

•path = dist/cli.js kind = oversized_source_file sizeBytes = 7899259 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 7899259 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

Source & flagged code

18 flagged · loading source

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L1

Critical

Credential Exfiltration

Findings

5 Critical9 High7 Medium6 Low

CriticalSame File Env Network Executiondist/cli.js

CriticalCredential Exfiltrationdist/cli.js

CriticalRemote Response Code Executiondist/cli.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighEval

HighCredential Redirect Persistencedist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighObfuscated Payload Loaderdist/cli.js

HighRemote Agent Bridgedist/cli.js

HighTrigger Reachable Credential Exfiltrationdist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/cli.js

Affected versions and remediation

This report applies to @deepseekcode/cli@1.0.26.

See all versions of @deepseekcode/cli for other recorded verdicts.

Review the evidence and your use of @deepseekcode/cli@1.0.26 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 20:24:32.068Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.