registry  /  @gbits-jszx/dg-cli  /  0.8.37

@gbits-jszx/dg-cli@0.8.37

DataGateway CLI — 部署/运维/配置一站式（Go binary，npx 分发）

AI Security Review

scanned 12d ago · by lpm-firewall-ai

No confirmed malicious attack surface in the inspected package source. The package is a CLI bootstrapper that resolves and runs a platform optional dependency, with a benign npm registry version check.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs dg-cli or npx @gbits-jszx/dg-cli.
Impact
Executes the declared DataGateway CLI binary selected by platform; no source evidence of exfiltration or unauthorized behavior in this package.
Mechanism
CLI wrapper delegates to platform binary and checks npm latest tag.
Rationale
Static inspection shows a declared npx CLI shim with no lifecycle hook and no hidden source behavior beyond a package-aligned version check and user-invoked binary delegation. Scanner findings are explained by expected CLI wrapper primitives rather than concrete malicious behavior.
Evidence
package.jsonREADME.mdbin/dg-cli.jsnode_modules/@gbits-jszx/dg-cli-<platform>-<arch>/bin/dg-cli[.exe]
Network endpoints2
registry.npmjs.org/-/package/@gbits-jszx/dg-cli/dist-tagsm68gitlab.g-bits.com/jszx-infra/datagateway.git

Decision evidence

public snapshot
AI called this Clean at 88.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • bin/dg-cli.js invokes a platform optional-dependency native binary with inherited stdio/env when the user runs the CLI.
  • bin/dg-cli.js performs an async version check over HTTPS to npm registry.
  • bin/dg-cli.js may chmod the resolved binary after EACCES.
Evidence against
  • package.json has no lifecycle scripts, so no install-time execution in this package.
  • Network access is limited to npm dist-tags version checking and can be disabled with DG_NPX_NO_VERSION_CHECK.
  • No credential harvesting, persistence, destructive writes, or AI-agent control-surface mutation found.
  • child_process use is the declared CLI bootstrap behavior, passing user arguments to the platform binary.
  • Package files are limited to package.json, README.md, and bin/dg-cli.js.
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 4.92 KB of source, external domains: registry.npmjs.org

Source & flagged code

4 flagged · loading source
bin/dg-cli.jsView file
5"use strict"; L6: const { execFileSync } = require("child_process"); L7: ... L18: function checkLatestAsync() { L19: if (process.env.DG_NPX_NO_VERSION_CHECK) return; // 离线/CI 用环境变量短路 L20: try { L21: const https = require("https"); L22: const localVer = require("../package.json").version;
Critical
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/dg-cli.jsView on unpkg · L5
•Trigger-reachable chain: manifest.bin -> bin/dg-cli.js Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/dg-cli.jsView on unpkg
5"use strict"; L6: const { execFileSync } = require("child_process"); L7:
High
Child Process

Package source references child process execution.

bin/dg-cli.jsView on unpkg · L5
1#!/usr/bin/env node L2: // dg-cli npm bootstrap: 按 process.platform/arch 解析对应平台子包二进制并透传调用。 L3: // 设计原则：stdio inherit + 默认 cwd + 默认 env，确保子进程感知到的运行环境与直接跑二进制完全一致。 ... L5: "use strict"; L6: const { execFileSync } = require("child_process"); L7: ... L18: function checkLatestAsync() { L19: if (process.env.DG_NPX_NO_VERSION_CHECK) return; // 离线/CI 用环境变量短路 L20: try { L21: const https = require("https"); L22: const localVer = require("../package.json").version; L23: const url = "https://registry.npmjs.org/-/package/@gbits-jszx/dg-cli/dist-tags";
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/dg-cli.jsView on unpkg · L1

Findings

2 Critical2 High3 Medium2 Low
CriticalSame File Env Network Executionbin/dg-cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/dg-cli.js
HighChild Processbin/dg-cli.js
HighSandbox Evasion Gated Capabilitybin/dg-cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowUrl Strings