registry  /  @gbits-jszx/dg-cli  /  0.8.36

@gbits-jszx/dg-cli@0.8.36

DataGateway CLI — 部署/运维/配置一站式（Go binary，npx 分发）

AI Security Review

scanned 12d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established in the inspected source. The package is a CLI bootstrapper that resolves a platform-specific optional dependency binary, checks npm latest version, and forwards user CLI arguments to that binary.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs dg-cli or npx @gbits-jszx/dg-cli
Impact
Runs package-aligned CLI binary with inherited user environment; no source evidence of exfiltration or unauthorized behavior in this wrapper package.
Mechanism
platform binary bootstrap with npm registry version check
Rationale
Static inspection shows risky primitives are package-aligned for an npm-distributed CLI wrapper: deterministic binary dispatch, inherited environment for CLI behavior, and a bounded version check. There is no lifecycle execution, credential/file harvesting, suspicious endpoint, persistence, destructive action, or reviewer/prompt manipulation in the package source.
Evidence
package.jsonbin/dg-cli.jsREADME.mdbin/dg-cli.js chmods resolved optional dependency binary on EACCES
Network endpoints1
registry.npmjs.org/-/package/@gbits-jszx/dg-cli/dist-tags

Decision evidence

public snapshot
AI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for block
  • bin/dg-cli.js executes a platform binary from optional dependency via execFileSync with inherited stdio/env
  • bin/dg-cli.js passes full process.env to the child binary
  • bin/dg-cli.js performs an async npm registry version check at runtime
  • bin/dg-cli.js may chmod the resolved binary on EACCES
Evidence against
  • package.json has no install/preinstall/postinstall lifecycle scripts
  • Published package contains only package.json, README.md, and bin/dg-cli.js wrapper
  • Network use is limited to npm dist-tags version check and can be disabled with DG_NPX_NO_VERSION_CHECK
  • No credential harvesting, arbitrary shell command construction, persistence, destructive behavior, or AI-agent control-surface writes found in inspected source
  • execFileSync target is resolved from deterministic platform optional dependency path, not attacker-controlled argv
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 4.92 KB of source, external domains: registry.npmjs.org

Source & flagged code

4 flagged · loading source
bin/dg-cli.jsView file
5"use strict"; L6: const { execFileSync } = require("child_process"); L7: ... L18: function checkLatestAsync() { L19: if (process.env.DG_NPX_NO_VERSION_CHECK) return; // 离线/CI 用环境变量短路 L20: try { L21: const https = require("https"); L22: const localVer = require("../package.json").version;
Critical
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/dg-cli.jsView on unpkg · L5
•Trigger-reachable chain: manifest.bin -> bin/dg-cli.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/dg-cli.jsView on unpkg
5"use strict"; L6: const { execFileSync } = require("child_process"); L7:
High
Child Process

Package source references child process execution.

bin/dg-cli.jsView on unpkg · L5
1#!/usr/bin/env node L2: // dg-cli npm bootstrap: 按 process.platform/arch 解析对应平台子包二进制并透传调用。 L3: // 设计原则：stdio inherit + 默认 cwd + 默认 env，确保子进程感知到的运行环境与直接跑二进制完全一致。 ... L5: "use strict"; L6: const { execFileSync } = require("child_process"); L7: ... L18: function checkLatestAsync() { L19: if (process.env.DG_NPX_NO_VERSION_CHECK) return; // 离线/CI 用环境变量短路 L20: try { L21: const https = require("https"); L22: const localVer = require("../package.json").version; L23: const url = "https://registry.npmjs.org/-/package/@gbits-jszx/dg-cli/dist-tags";
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/dg-cli.jsView on unpkg · L1

Findings

2 Critical2 High3 Medium2 Low
CriticalSame File Env Network Executionbin/dg-cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/dg-cli.js
HighChild Processbin/dg-cli.js
HighSandbox Evasion Gated Capabilitybin/dg-cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowUrl Strings