registry / Remote code execution / @gobi-starweaver/ws-cli
@gobi-starweaver/ws-cli
北辰计划·望舒 Polaris·WS — 面向史学与人文研究的终端智能体（WS CLI）
This report shows the evidence for @gobi-starweaver/ws-cli@0.3.7. 1 of 14 known versions is blocked or flagged. The newest version, 0.4.8, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package contains a concrete automatic remote-code execution path that runs after normal CLI use without a user confirmation step. Its fixed gateway also receives the package's stored authentication token.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs ws from a managed .ws installation while automatic updates are enabled and an update is advertised.
Impact
Remote server control can lead to arbitrary code execution as the CLI user and exposure of gateway credentials and device identifiers.
Mechanism
Remote installer download followed by detached shell execution.
Attack narrative
The executable starts a background update check after launch. When the remote manifest reports an update, automatic updates default on and it downloads an installer from the vendor distribution host, stores it under .ws/update, and launches it silently and detached through Bash or PowerShell. The expected installer hash comes from the same remotely fetched manifest, so it does not provide an independent trust boundary. The client also uses the locally stored card token as its API key against a fixed vendor gateway.
AI rationale
This package contains a concrete automatic remote-code execution path that runs after normal CLI use without a user confirmation step. Its fixed gateway also receives the package's stored authentication token.
Evidence
cli.js~/.ws/update/~/.ws/auth.json~/.ws/machine-id
Network endpoints3
gobi-starweaver.cn/dist/version.jsongobi-starweaver.cn/distapi.gobi-starweaver.cn:8443/v1
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI automatically checks a vendor-hosted update manifest and can launch a detached silent installer.
- The installer is downloaded from a remote URL, written under the user's .ws directory, then executed with Bash or PowerShell.
- The CLI routes its stored authentication token and device identifier to a fixed vendor gateway.
Evidence against
- package.json contains no npm lifecycle scripts.
- The remote installer path is reached when the user runs the CLI from its managed .ws installation, not during npm installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
13 flagged · loading sourcemcp/servers/doc-toolchain-server.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @gobi-starweaver/ws-cli@0.3.5
matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.3.5
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
mcp/servers/doc-toolchain-server.jsView on unpkg944init_esbuild_shims();
L945: import { spawn } from "node:child_process";
L946: import * as fs from "node:fs";
High
Child Process
Package source references child process execution.
mcp/servers/doc-toolchain-server.jsView on unpkg · L944cli.jsView file
6Source sends the broad process environment to a literal external destination.
L6: __commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
Findings
2 Critical7 High6 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcli.js
CriticalPrevious Version Dangerous Deltamcp/servers/doc-toolchain-server.js
HighChild Processmcp/servers/doc-toolchain-server.js
HighShellcli.js
HighCredential Redirect Persistencecli.js
HighSandbox Evasion Gated Capabilitycli.js
HighObfuscated Payload Loadercli.js
HighCross File Remote Execution Contextcli.js
HighSemantic Analysis Limitedcli.js
MediumDynamic Requirecli.js
MediumEnvironment Vars
MediumShips Build Helpervendor/hj_corpus/hj_corpus_mcp_server.py
Affected versions and remediation
This report applies to @gobi-starweaver/ws-cli@0.3.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing @gobi-starweaver/ws-cli@0.3.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.