Loading npm security reports…

@gobi-starweaver/ws-cli@0.3.7: Malicious npm security report | LPM Firewall

registry / @gobi-starweaver/ws-cli / 0.3.7

@gobi-starweaver/ws-cli@0.3.7

北辰计划·望舒 Polaris·WS — 面向史学与人文研究的终端智能体（WS CLI）

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Running the managed CLI can silently download and execute a remotely supplied installer. It also sends its authentication token and device identifier to the package's fixed gateway.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs ws from a managed .ws installation while automatic updates are enabled and an update is advertised.

Impact

Remote server control can lead to arbitrary code execution as the CLI user and exposure of gateway credentials and device identifiers.

Mechanism

Remote installer download followed by detached shell execution.

Attack narrative

The executable starts a background update check after launch. When the remote manifest reports an update, automatic updates default on and it downloads an installer from the vendor distribution host, stores it under .ws/update, and launches it silently and detached through Bash or PowerShell. The expected installer hash comes from the same remotely fetched manifest, so it does not provide an independent trust boundary. The client also uses the locally stored card token as its API key against a fixed vendor gateway.

Rationale

This package contains a concrete automatic remote-code execution path that runs after normal CLI use without a user confirmation step. Its fixed gateway also receives the package's stored authentication token.

Evidence

cli.js~/.ws/update/~/.ws/auth.json~/.ws/machine-id

Network endpoints3

gobi-starweaver.cn/dist/version.json/dist

Source & flagged code

13 flagged · loading source

mcp/servers/doc-toolchain-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gobi-starweaver/ws-cli@0.3.5 matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.3.5 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

mcp/servers/doc-toolchain-server.jsView on unpkg

944init_esbuild_shims(); L945: import { spawn } from "node:child_process"; L946: import * as fs from "node:fs";

High

Child Process

Package source references child process execution.

mcp/servers/doc-toolchain-server.jsView on unpkg · L944

cli.jsView file

6Source sends the broad process environment to a literal external destination. L6: __commonJS, L7: __dirname, L8: __export, ... L495: ]; L496: if (process.platform !== "win32") { L497: module2.exports.push( ... L644: } L645: process24.exitCode = code || /* istanbul ignore next */ L646: 0; ... L1020: function formatProdErrorMessage(code) { L1021: var url2 = "https://react.dev/errors/" + code; L1022: if (1 < arguments.length) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

cli.jsView on unpkg · L6

72548if (process.platform === "win32") { L72549: return `cmd.exe /c "taskkill /PID ${processId} /T /F"`; L72550: }

High

Shell

Package source references shell execution.

cli.jsView on unpkg · L72548

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli.js: "Authorization", "Proxy-Authorization", get baseUrl() { return this.baseUrl?.origin; this[kProxyHeaders]["proxy-authorization"] = `Basic ${opts.auth}`; this[kProxyHeaders]["proxy-authorization"] = opts.token; this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString("base64")}`; const existProxyAuth = headers && Object.keys(headers).find((key) => key.toLowerCase() === "proxy-authorization");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli.jsView on unpkg

6__commonJS, L7: __dirname, L8: __export, ... L495: ]; L496: if (process.platform !== "win32") { L497: module2.exports.push( ... L644: } L645: process24.exitCode = code || /* istanbul ignore next */ L646: 0; ... L1020: function formatProdErrorMessage(code) { L1021: var url2 = "https://react.dev/errors/" + code; L1022: if (1 < arguments.length) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.jsView on unpkg · L6

6__commonJS, L7: __dirname, L8: __export, ... L495: ]; L496: if (process.platform !== "win32") { L497: module2.exports.push( ... L644: } L645: process24.exitCode = code || /* istanbul ignore next */ L646: 0; ... L1020: function formatProdErrorMessage(code) { L1021: var url2 = "https://react.dev/errors/" + code; L1022: if (1 < arguments.length) {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

cli.jsView on unpkg · L6

6Cross-file remote execution chain: cli.js spawns chunks/devtools-V5WI5QLO.js; helper contains network access plus dynamic code execution. L6: __commonJS, L7: __dirname, L8: __export, ... L495: ]; L496: if (process.platform !== "win32") { L497: module2.exports.push( ... L644: } L645: process24.exitCode = code || /* istanbul ignore next */ L646: 0; ... L1020: function formatProdErrorMessage(code) { L1021: var url2 = "https://react.dev/errors/" + code; L1022: if (1 < arguments.length) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L6

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli.jsView on unpkg

536} else { L537: assert2 = __require("assert"); L538: signals = require_signals();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli.jsView on unpkg · L536

•path = cli.js kind = oversized_source_file sizeBytes = 5279832 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

cli.jsView on unpkg

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 5279832 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

vendor/hj_corpus/hj_corpus_mcp_server.pyView file

•path = vendor/hj_corpus/hj_corpus_mcp_server.py kind = build_helper sizeBytes = 21718 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/hj_corpus/hj_corpus_mcp_server.pyView on unpkg

Source & flagged code

13 flagged

mcp/servers/doc-toolchain-server.jsView file

Lines 924-964javascript

924 }))

925 ].sort((a, b) => b.start - a.start || a.kind - b.kind || b.seq - a.seq);

926 let nextXml = documentXml;

927 for (const edit of edits) {

928 nextXml = nextXml.slice(0, edit.start) + edit.xml + nextXml.slice(edit.end);

929 }

930 const after = walkBody(tokenizeXml(nextXml));

931 const nextEntries = entries.map(

932 (entry) => entry.name === "word/document.xml" ? { name: entry.name, data: Buffer.from(nextXml, "utf8") } : { name: entry.name, data: inflateZipEntry(entry) }

933 );

934 return {

935 buffer: writeZip(nextEntries),

936 applied: ops.length,

937 paragraphCountBefore: walk.paragraphSpans.length,

938 paragraphCountAfter: after.paragraphSpans.length

939 };

940}

941__name(editDocx, "editDocx");

942

943// packages/core/src/mcp/servers/doc-toolchain/convert.ts

944init_esbuild_shims();

945import { spawn } from "node:child_process";

946import * as fs from "node:fs";

High

Child Process

Package source references child process execution.

mcp/servers/doc-toolchain-server.jsView on unpkg · L944

947import * as os from "node:os";

948import * as path from "node:path";

949import { pathToFileURL } from "node:url";

950var OUTPUT_CAPTURE_LIMIT = 64 * 1024;

951function appendCapped(previous, chunk) {

952 if (previous.length >= OUTPUT_CAPTURE_LIMIT) return previous;

953 return (previous + chunk).slice(0, OUTPUT_CAPTURE_LIMIT);

954}

955__name(appendCapped, "appendCapped");

956var defaultRunProcess = /* @__PURE__ */ __name((command, args, options) => new Promise((resolve3) => {

957 let settled = false;

958 let child;

959 try {

960 child = spawn(command, args, {

961 env: options.env,

962 shell: false,

963 windowsHide: true

964 });

•matchType = previous_version_dangerous_delta matchedPackage = @gobi-starweaver/ws-cli@0.3.5 matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.3.5 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

mcp/servers/doc-toolchain-server.jsView on unpkg

cli.jsView file

6Source sends the broad process environment to a literal external destination. L6: __commonJS, L7: __dirname, L8: __export, ... L495: ]; L496: if (process.platform !== "win32") { L497: module2.exports.push( ... L644: } L645: process24.exitCode = code || /* istanbul ignore next */ L646: 0; ... L1020: function formatProdErrorMessage(code) { L1021: var url2 = "https://react.dev/errors/" + code; L1022: if (1 < arguments.length) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

cli.jsView on unpkg · L6

72548if (process.platform === "win32") { L72549: return `cmd.exe /c "taskkill /PID ${processId} /T /F"`; L72550: }

High

Shell

Package source references shell execution.

cli.jsView on unpkg · L72548

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli.js: "Authorization", "Proxy-Authorization", get baseUrl() { return this.baseUrl?.origin; this[kProxyHeaders]["proxy-authorization"] = `Basic ${opts.auth}`; this[kProxyHeaders]["proxy-authorization"] = opts.token; this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString("base64")}`; const existProxyAuth = headers && Object.keys(headers).find((key) => key.toLowerCase() === "proxy-authorization");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

vendor/hj_corpus/hj_corpus_mcp_server.pyView file

•path = vendor/hj_corpus/hj_corpus_mcp_server.py kind = build_helper sizeBytes = 21718 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/hj_corpus/hj_corpus_mcp_server.pyView on unpkg