registry / @deveco-test/deveco-cli-common / 0.1.0
@deveco-test/deveco-cli-common@0.1.0
⚠ Under reviewHarmonyOS application development command line tool
AI Security Review
scanned 1mo ago · by lpm-firewall-aiA clean verdict requires a validated citation for docs.zip, but that required binary exceeds the citation verifier limit. The inspected source does not establish a concrete attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the declared postinstall hook.
Impact
No malicious impact was confirmed; archive contents remain unverified.
Mechanism
A detached Node process invokes the packaged documentation initializer.
AI rationale
A clean verdict requires a validated citation for docs.zip, but that required binary exceeds the citation verifier limit. The inspected source does not establish a concrete attack.
Evidence
scripts/postinstall.mjsdist/internal/doc-init-background.js
Decision evidence
public snapshotAI called this Manual Review at 86.0% confidence as Unknown with low false-positive risk.
AI review observations
- The package declares an automatic postinstall hook.
- The required docs.zip artifact could not be source-cited because it exceeds the citation verifier limit.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/internal/telemetry-upload-background.jsView file
8`)+`
L9: `;await m.promises.appendFile(i,o,"utf8")}catch(o){s.error("[telemetry] move to failed error:",o);return}try{await m.promises.unlink(t)}catch{}}};var I=new T;import{spawn as je}fro...
High
Child Process
Findings
8 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/internal/telemetry-upload-background.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/internal/telemetry-upload-background.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/internal/telemetry-upload-background.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighShips High Entropy Blobdocs.zip
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/cli.js
MediumEnvironment Vars
MediumShips Compressed Blobdocs.zip
Affected versions and remediation
This report applies to @deveco-test/deveco-cli-common@0.1.0.
See all versions of @deveco-test/deveco-cli-common for other recorded verdicts.
- Review the evidence and your use of @deveco-test/deveco-cli-common@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.