registry / @douyin-minigame/cli / 0.5.0
@douyin-minigame/cli@0.5.0
抖音小游戏 CLI
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe manifest defines a CLI entrypoint without lifecycle hooks. The bundle’s reporting is activated by user-invoked commands and sends package-aligned telemetry; the inspected source does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes a CLI command.
Impact
Telemetry leaves the machine; the inspected destination is package-aligned, and the source review found no concrete attack chain.
Mechanism
The command hook collects command details and sends them through the configured telemetry SDK.
AI rationale
The manifest defines a CLI entrypoint without lifecycle hooks. The bundle’s reporting is activated by user-invoked commands and sends package-aligned telemetry; the inspected source does not establish malicious behavior.
Evidence
dist/cli.js
Network endpoints1
mcs.zijieapi.com
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes dist/cli.js as a command-line entrypoint and defines no lifecycle scripts.
- The CLI reports command names, request parameters, account identifiers, and result status through its bundled Tea SDK.
- The bundled telemetry SDK uses ByteDance reporting endpoints and is configured for its China channel.
- Reporting is activated by invoking a CLI command; no install-time trigger is present.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/cli.jsView file
6custom: {/** custom content */},
L7: })`);let r=e.header||{},{custom:n}=r,u=i(r,["custom"]);this.customField=JSON.parse(n||"{}"),Object.assign(this.partialHeaderFields,u),Object.assign(this.userFields,e.user),Object.a...
L8: ${u}`)}boxWrap(e,t){if(t<this.minWidthToWrap)return e;let r=e.split(/\r\n|\n/),i=/[\s]*[^\s]+/g,n=[];return r.forEach(e=>{let r=e.match(i);if(null===r)return void n.push("");let u=...
High
18Expecting one of '${r.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e...
L19: - already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=e=>[e.name()].concat(e.aliases()),r=t(e).find(e=>this._findCommand(...
L20: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...
High
6custom: {/** custom content */},
L7: })`);let r=e.header||{},{custom:n}=r,u=i(r,["custom"]);this.customField=JSON.parse(n||"{}"),Object.assign(this.partialHeaderFields,u),Object.assign(this.userFields,e.user),Object.a...
L8: ${u}`)}boxWrap(e,t){if(t<this.minWidthToWrap)return e;let r=e.split(/\r\n|\n/),i=/[\s]*[^\s]+/g,n=[];return r.forEach(e=>{let r=e.match(i);if(null===r)return void n.push("");let u=...
Findings
6 High4 Medium5 Low
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighObfuscated Payload Loaderdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @douyin-minigame/cli@0.5.0.
See all versions of @douyin-minigame/cli for other recorded verdicts.
- Review the evidence and your use of @douyin-minigame/cli@0.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.