@gobi-starweaver/ws-cli@0.4.1
北辰计划·望舒 Polaris·WS — 面向史学与人文研究的终端智能体（WS CLI）
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection confirms an automatically triggered, remotely supplied installer execution path. Hashing does not independently authenticate the payload because its expected value is fetched from the same server.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Running the ws CLI from an installation under ~/.ws while automatic updates are enabled and a newer manifest version is reported.
Impact
A compromise or malicious response from the update service can run arbitrary code as the CLI user.
Mechanism
Remote installer download followed by silent shell execution.
AI rationale
Source inspection confirms an automatically triggered, remotely supplied installer execution path. Hashing does not independently authenticate the payload because its expected value is fetched from the same server.
Evidence
cli.js~/.ws/update
Network endpoints2
gobi-starweaver.cn/dist/version.jsongobi-starweaver.cn/dist
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI downloads an installer script from the vendor host and writes it locally.
- It launches the downloaded script silently with Bash or PowerShell execution-policy bypass.
- Auto-update is enabled by default and can start the silent installer during CLI startup.
- The manifest and installer hash are both supplied by the same remote service, so the package does not embed an independent trust root.
Evidence against
- package.json contains no npm lifecycle hooks.
- The remote installer is SHA-256 checked against the fetched manifest before execution.
- The self-update path is limited to CLI installations located under ~/.ws.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
18 flagged · loading sourcemcp/servers/doc-toolchain-server.jsView file
944init_esbuild_shims();
L945: import { spawn } from "node:child_process";
L946: import * as fs from "node:fs";
High
Child Process
Package source references child process execution.
mcp/servers/doc-toolchain-server.jsView on unpkg · L944•matchType = normalized_sha256
matchedPackage = @gobi-starweaver/ws-cli@0.3.7
matchedPath = mcp/servers/doc-toolchain-server.js
matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.3.7
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
mcp/servers/doc-toolchain-server.jsView on unpkgvendor/vision-render/src/worker-launcher.mjsView file
64executable = process.env.SystemRoot
L65: ? resolve(process.env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
L66: : "powershell.exe";
Findings
4 Critical10 High7 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcli.js
CriticalCredential Exfiltrationcli.js
CriticalRemote Asset Decode Executecli.js
CriticalTrigger Reachable Dangerous Capabilitycli.js
HighChild Processmcp/servers/doc-toolchain-server.js
HighShellvendor/vision-render/src/worker-launcher.mjs
HighCredential Redirect Persistencecli.js
HighSandbox Evasion Gated Capabilitycli.js
HighObfuscated Payload Loadercli.js
HighCross File Remote Execution Contextcli.js
HighTrigger Reachable Credential Exfiltrationcli.js
HighSemantic Analysis Limited
Affected versions and remediation
This report applies to @gobi-starweaver/ws-cli@0.4.1.
See all versions of @gobi-starweaver/ws-cli for other recorded verdicts.
- Review the evidence and your use of @gobi-starweaver/ws-cli@0.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.