@gobi-starweaver/ws-cli@0.3.6
北辰计划·望舒 Polaris·WS — 面向史学与人文研究的终端智能体（WS CLI）
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes a remote silent self-update execution path, but it is limited to managed installations and does not run during npm installation. This warrants a warning rather than a malicious publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Run the ws CLI from a managed .ws installation when an update is available and automatic updates are enabled.
Impact
A compromised vendor update service could execute arbitrary code as the CLI user.
Mechanism
Remote manifest-controlled silent installer download and execution.
AI rationale
The source establishes a remote silent self-update execution path, but it is limited to managed installations and does not run during npm installation. This warrants a warning rather than a malicious publish block.
Evidence
cli.js~/.ws/update
Network endpoints2
gobi-starweaver.cn/distgobi-starweaver.cn/dist/version.json
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI can download a shell or PowerShell installer from the vendor distribution site.
- It obtains the installer hash from the same remotely fetched manifest, then starts the installer automatically in the background.
- The downloaded installer is executed silently with bash or PowerShell execution-policy bypass.
Evidence against
- package.json has no npm lifecycle scripts or dependencies.
- The updater is gated to a managed installation under the package's own .ws directory, so it is inactive for an ordinary npm-installed bin path.
- The document converter uses argument-vector spawning with shell disabled.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
16 flagged · loading sourcemcp/servers/doc-toolchain-server.jsView file
944init_esbuild_shims();
L945: import { spawn } from "node:child_process";
L946: import * as fs from "node:fs";
High
Child Process
Package source references child process execution.
mcp/servers/doc-toolchain-server.jsView on unpkg · L944•matchType = normalized_sha256
matchedPackage = @gobi-starweaver/ws-cli@0.3.7
matchedPath = mcp/servers/doc-toolchain-server.js
matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.3.7
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
mcp/servers/doc-toolchain-server.jsView on unpkgcli.jsView file
6Source sends the broad process environment to a literal external destination.
L6: __commonJS,
L7: __dirname,
L8: __export,
...
L495: ];
L496: if (process.platform !== "win32") {
L497: module2.exports.push(
...
L644: }
L645: process24.exitCode = code || /* istanbul ignore next */
L646: 0;
...
L1020: function formatProdErrorMessage(code) {
L1021: var url2 = "https://react.dev/errors/" + code;
L1022: if (1 < arguments.length) {
Findings
2 Critical10 High6 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcli.js
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processmcp/servers/doc-toolchain-server.js
HighShellcli.js
HighCredential Redirect Persistencecli.js
HighSandbox Evasion Gated Capabilitycli.js
HighObfuscated Payload Loadercli.js
HighCross File Remote Execution Contextcli.js
HighSemantic Analysis Limitedcli.js
HighKnown Malware Source Similaritycli.js
HighKnown Malware Source Similaritymcp/servers/doc-toolchain-server.js
HighKnown Malware Source Fingerprint Signature
Affected versions and remediation
This report applies to @gobi-starweaver/ws-cli@0.3.6.
See all versions of @gobi-starweaver/ws-cli for other recorded verdicts.
- Review the evidence and your use of @gobi-starweaver/ws-cli@0.3.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.