registry / @gbits-jszx/dg-cli / 0.8.56

@gbits-jszx/dg-cli@0.8.56

⚠ Under review

DataGateway CLI — 部署/运维/配置一站式（Go binary，npx 分发）

Static Scan Results

scanned 12h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 4.92 KB of source, external domains: registry.npmjs.org

Source & flagged code

4 flagged

bin/dg-cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// dg-cli npm bootstrap: 按 process.platform/arch 解析对应平台子包二进制并透传调用。

3// 设计原则：stdio inherit + 默认 cwd + 默认 env，确保子进程感知到的运行环境与直接跑二进制完全一致。

5"use strict";

6const { execFileSync } = require("child_process");

High

Child Process

Package source references child process execution.

bin/dg-cli.jsView on unpkg · L5

8const platform = process.platform; // 'linux' / 'darwin' / 'win32'

9const arch = process.arch; // 'x64' / 'arm64'

10const pkg = `@gbits-jszx/dg-cli-${platform}-${arch}`;

11const exe = platform === "win32" ? "dg-cli.exe" : "dg-cli";

13// 后台异步比对本地版本与 npm registry latest（D5：零依赖、零阻塞、出错全静默）。

14// 不阻塞主进程：req.unref() 让请求不延长 process 生命周期；任意错误吞掉。

15// 实际能否打印 WARN 取决于 execFileSync 后 Node 是否还在 drain IO；

16// 长命令（helm install）期间响应早已 buffered → 大概率能打印；

17// 短命令（--version）可能来不及 → 静默丢弃，符合"不打扰用户"原则。

18function checkLatestAsync() {

19 if (process.env.DG_NPX_NO_VERSION_CHECK) return; // 离线/CI 用环境变量短路

20 try {

21 const https = require("https");

22 const localVer = require("../package.json").version;

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/dg-cli.jsView on unpkg · L5

23 const url = "https://registry.npmjs.org/-/package/@gbits-jszx/dg-cli/dist-tags";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/dg-cli.jsView on unpkg · L1

24 const req = https.get(url, { timeout: 1500 }, (res) => {

25 if (res.statusCode !== 200) { res.resume(); return; }

•Trigger-reachable chain: manifest.bin -> bin/dg-cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/dg-cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

bin/dg-cli.jsView file

5"use strict"; L6: const { execFileSync } = require("child_process"); L7: ... L18: function checkLatestAsync() { L19: if (process.env.DG_NPX_NO_VERSION_CHECK) return; // 离线/CI 用环境变量短路 L20: try { L21: const https = require("https"); L22: const localVer = require("../package.json").version;

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/dg-cli.jsView on unpkg · L5

•Trigger-reachable chain: manifest.bin -> bin/dg-cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/dg-cli.jsView on unpkg

5"use strict"; L6: const { execFileSync } = require("child_process"); L7:

High

Child Process

Package source references child process execution.

bin/dg-cli.jsView on unpkg · L5

1#!/usr/bin/env node L2: // dg-cli npm bootstrap: 按 process.platform/arch 解析对应平台子包二进制并透传调用。 L3: // 设计原则：stdio inherit + 默认 cwd + 默认 env，确保子进程感知到的运行环境与直接跑二进制完全一致。 ... L5: "use strict"; L6: const { execFileSync } = require("child_process"); L7: ... L18: function checkLatestAsync() { L19: if (process.env.DG_NPX_NO_VERSION_CHECK) return; // 离线/CI 用环境变量短路 L20: try { L21: const https = require("https"); L22: const localVer = require("../package.json").version; L23: const url = "https://registry.npmjs.org/-/package/@gbits-jszx/dg-cli/dist-tags";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/dg-cli.jsView on unpkg · L1

Findings

2 Critical2 High3 Medium2 Low

CriticalSame File Env Network Executionbin/dg-cli.js

CriticalTrigger Reachable Dangerous Capabilitybin/dg-cli.js

HighChild Processbin/dg-cli.js

HighSandbox Evasion Gated Capabilitybin/dg-cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowUrl Strings

Source & flagged code

4 flagged

bin/dg-cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// dg-cli npm bootstrap: 按 process.platform/arch 解析对应平台子包二进制并透传调用。

3// 设计原则：stdio inherit + 默认 cwd + 默认 env，确保子进程感知到的运行环境与直接跑二进制完全一致。

5"use strict";

6const { execFileSync } = require("child_process");

High

Child Process

Package source references child process execution.

bin/dg-cli.jsView on unpkg · L5

8const platform = process.platform; // 'linux' / 'darwin' / 'win32'

9const arch = process.arch; // 'x64' / 'arm64'

10const pkg = `@gbits-jszx/dg-cli-${platform}-${arch}`;

11const exe = platform === "win32" ? "dg-cli.exe" : "dg-cli";

13// 后台异步比对本地版本与 npm registry latest（D5：零依赖、零阻塞、出错全静默）。

14// 不阻塞主进程：req.unref() 让请求不延长 process 生命周期；任意错误吞掉。

15// 实际能否打印 WARN 取决于 execFileSync 后 Node 是否还在 drain IO；

16// 长命令（helm install）期间响应早已 buffered → 大概率能打印；

17// 短命令（--version）可能来不及 → 静默丢弃，符合"不打扰用户"原则。

18function checkLatestAsync() {

19 if (process.env.DG_NPX_NO_VERSION_CHECK) return; // 离线/CI 用环境变量短路

20 try {

21 const https = require("https");

22 const localVer = require("../package.json").version;

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/dg-cli.jsView on unpkg · L5

23 const url = "https://registry.npmjs.org/-/package/@gbits-jszx/dg-cli/dist-tags";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/dg-cli.jsView on unpkg · L1

24 const req = https.get(url, { timeout: 1500 }, (res) => {

25 if (res.statusCode !== 200) { res.resume(); return; }

•Trigger-reachable chain: manifest.bin -> bin/dg-cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/dg-cli.jsView on unpkg