@gobi-starweaver/ws-cli@0.3.8
北辰计划·望舒 Polaris·WS — 面向史学与人文研究的终端智能体（WS CLI）
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is an automatic remote-code execution channel triggered during ordinary CLI use, without an independently pinned update signature. It is a concrete dangerous capability, but the package contains no npm install lifecycle trigger or direct evidence that the current release steals data or performs a destructive action.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user starts the CLI from a WS-managed installation with automatic updates enabled.
Impact
A party controlling the distribution host or its manifest can obtain code execution as the CLI user.
Mechanism
Automatic remote installer download followed by silent shell execution.
AI rationale
This is an automatic remote-code execution channel triggered during ordinary CLI use, without an independently pinned update signature. It is a concrete dangerous capability, but the package contains no npm install lifecycle trigger or direct evidence that the current release steals data or performs a destructive action.
Evidence
cli.js~/.ws/update
Network endpoints2
gobi-starweaver.cn/dist/version.jsongobi-starweaver.cn/dist
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI downloads an installer script from a package-controlled distribution host and saves it under the user's WS directory.
- It executes the downloaded script silently with Bash or PowerShell using ExecutionPolicy Bypass.
- The expected installer hash is obtained from the same remote manifest, so it is not an independent trust anchor.
- The update check and automatic installer launch run during normal CLI startup, with automatic updates enabled by default.
Evidence against
- package.json has no npm lifecycle scripts.
- The updater only activates for a CLI entry installed beneath the user's WS directory, not merely when npm installs this package.
- The code compares the downloaded installer to a manifest-supplied SHA-256 value before execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
17 flagged · loading sourcemcp/servers/doc-toolchain-server.jsView file
944init_esbuild_shims();
L945: import { spawn } from "node:child_process";
L946: import * as fs from "node:fs";
High
Child Process
Package source references child process execution.
mcp/servers/doc-toolchain-server.jsView on unpkg · L944•matchType = normalized_sha256
matchedPackage = @gobi-starweaver/ws-cli@0.3.7
matchedPath = mcp/servers/doc-toolchain-server.js
matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.3.7
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
mcp/servers/doc-toolchain-server.jsView on unpkgvendor/vision-render/src/worker-launcher.mjsView file
64executable = process.env.SystemRoot
L65: ? resolve(process.env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
L66: : "powershell.exe";
Findings
4 Critical9 High7 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcli.js
CriticalRemote Asset Decode Executecli.js
CriticalTrigger Reachable Dangerous Capabilitycli.js
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processmcp/servers/doc-toolchain-server.js
HighShellvendor/vision-render/src/worker-launcher.mjs
HighCredential Redirect Persistencecli.js
HighSandbox Evasion Gated Capabilitycli.js
HighObfuscated Payload Loadercli.js
HighCross File Remote Execution Contextcli.js
HighSemantic Analysis Limitedcli.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @gobi-starweaver/ws-cli@0.3.8.
See all versions of @gobi-starweaver/ws-cli for other recorded verdicts.
- Review the evidence and your use of @gobi-starweaver/ws-cli@0.3.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.