@gobi-starweaver/ws-cli@0.4.2
北辰计划·望舒 Polaris·WS — 面向史学与人文研究的终端智能体（WS CLI）
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a real guarded runtime remote-code execution channel, but source inspection found no npm lifecycle attack, unrelated secret theft, or destructive behavior. It warrants a warning rather than a malicious publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running the ws CLI from its managed WS installation path when automatic updates are enabled and an update is offered.
Impact
A compromised update service or manifest could cause arbitrary code execution as the CLI user.
Mechanism
Download and detached execution of a remote shell or PowerShell installer.
AI rationale
This is a real guarded runtime remote-code execution channel, but source inspection found no npm lifecycle attack, unrelated secret theft, or destructive behavior. It warrants a warning rather than a malicious publish block.
Evidence
cli.jschunks/chunk-SNEWN2VZ.js
Network endpoints1
gobi-starweaver.cn/dist
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runtime fetches an installer script from the vendor distribution server and writes it locally.
- It launches that downloaded script detached and silently through Bash or PowerShell.
- The CLI starts background update checks when its managed-install guard passes.
Evidence against
- The manifest has no install, postinstall, or preinstall lifecycle hook.
- The self-update path is disabled unless the executable is located beneath the WS managed directory.
- No source evidence showed credential harvesting or exfiltration unrelated to the CLI service.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
16 flagged · loading sourcemcp/servers/doc-toolchain-server.jsView file
944init_esbuild_shims();
L945: import { spawn } from "node:child_process";
L946: import * as fs from "node:fs";
High
Child Process
Package source references child process execution.
mcp/servers/doc-toolchain-server.jsView on unpkg · L944•matchType = normalized_sha256
matchedPackage = @gobi-starweaver/ws-cli@0.3.7
matchedPath = mcp/servers/doc-toolchain-server.js
matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.3.7
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
mcp/servers/doc-toolchain-server.jsView on unpkgchunks/chunk-SNEWN2VZ.jsView file
6Source sends the broad process environment to a literal external destination.
L6: __commonJS,
L7: __dirname,
L8: __export,
...
L15:
L16: // node_modules/undici/lib/core/symbols.js
L17: var require_symbols = __commonJS({
...
L42: kBodyUsed: /* @__PURE__ */ Symbol("used"),
L43: kBody: /* @__PURE__ */ Symbol("abstracted request body"),
L44: kRunning: /* @__PURE__ */ Symbol("running"),
...
L163: * @type {-2|-1|0|1}
L164: * @private
L165: */
Findings
4 Critical10 High5 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationchunks/chunk-SNEWN2VZ.js
CriticalCredential Exfiltrationchunks/chunk-SNEWN2VZ.js
CriticalTrigger Reachable Dangerous Capabilitychunks/chunk-SNEWN2VZ.js
CriticalPrevious Version Dangerous Deltacli.js
HighChild Processmcp/servers/doc-toolchain-server.js
HighShellchunks/chunk-SNEWN2VZ.js
HighEntrypoint Build Divergencecli.js
HighCredential Redirect Persistencecli.js
HighSandbox Evasion Gated Capabilitychunks/chunk-SNEWN2VZ.js
HighObfuscated Payload Loaderchunks/chunk-SNEWN2VZ.js
HighCross File Remote Execution Contextchunks/chunk-SNEWN2VZ.js
Affected versions and remediation
This report applies to @gobi-starweaver/ws-cli@0.4.2.
See all versions of @gobi-starweaver/ws-cli for other recorded verdicts.
- Review the evidence and your use of @gobi-starweaver/ws-cli@0.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.