registry / @deveco-test/deveco-cli-common / 1.3.10-Test.1
@deveco-test/deveco-cli-common@1.3.10-Test.1
⚠ Under reviewHarmonyOS application development command line tool
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe inspected source does not establish malicious behavior, and the package manifest has no install-time hook. The declared knowledgebase dependency is unresolved and is dynamically loaded for documentation, so its behavior cannot be verified; manual review is warranted.
Static reason
One or more suspicious static signals were detected.
Trigger
A CLI documentation path may dynamically load the installed documentation engine.
Impact
The dependency's runtime behavior cannot be verified from this snapshot.
Mechanism
The CLI imports an engine from a candidate package directory; the available source does not establish what the unresolved dependency does.
AI rationale
The inspected source does not establish malicious behavior, and the package manifest has no install-time hook. The declared knowledgebase dependency is unresolved and is dynamically loaded for documentation, so its behavior cannot be verified; manual review is warranted.
Evidence
package.jsondist/cli.js
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares the knowledgebase package as a runtime dependency, and the CLI dynamically loads a documentation engine.
- The manifest scripts show publication and build tasks, with no preinstall, install, or postinstall hook.
Evidence against
- The available registry evidence marks the knowledgebase dependency unresolved, so its source behavior could not be assessed.
- The telemetry helper sends to a Huawei DevEco endpoint; the inspected source does not establish unrelated-recipient credential or data theft.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/internal/telemetry-upload-background.jsView file
8`)+`
L9: `,"utf8")}catch{return}try{await u.promises.unlink(t)}catch{}}takeNewestWithinBudget(t,e){if(e<=0)return[];let r=[],i=0;for(let o=t.length-1;o>=0;o--){let s=Buffer.byteLength(t[o],...
High
Child Process
Package source references child process execution.
dist/internal/telemetry-upload-background.jsView on unpkg · L81import Vt from"path";import*as S from"fs";import*as Y from"path";import{homedir as bt}from"os";import*as H from"fs";import*as g from"path";function W(n){let t=g.resolve(n),e=[],r=t...
L2: `;if(this.mode==="file"&&this.currentLogFile){if(this.fd===null&&this.openLogFile(),this.fd!==null)try{let p=Buffer.from(l);a.writeSync(this.fd,p),this.checkRotation(p.byteLength)}...
...
L8: `)+`
L9: `,"utf8")}catch{return}try{await u.promises.unlink(t)}catch{}}takeNewestWithinBudget(t,e){if(e<=0)return[];let r=[],i=0;for(let o=t.length-1;o>=0;o--){let s=Buffer.byteLength(t[o],...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/internal/telemetry-upload-background.jsView on unpkg · L1Findings
4 High4 Medium6 Low
HighChild Processdist/internal/telemetry-upload-background.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/internal/telemetry-upload-background.js
HighCommand Output Exfiltrationdist/internal/telemetry-upload-background.js
MediumDynamic Requiredist/cli.js
MediumEnvironment Vars
MediumShips Native Binarysrc/resources/uitest/uitest_agent_v1.1.9.so
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @deveco-test/deveco-cli-common@1.3.10-Test.1.
See all versions of @deveco-test/deveco-cli-common for other recorded verdicts.
- Review the evidence and your use of @deveco-test/deveco-cli-common@1.3.10-Test.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.