registry / @gobi-starweaver/ws-cli / 0.4.5

@gobi-starweaver/ws-cli@0.4.5

北辰计划·望舒 Polaris·WS — 面向史学与人文研究的终端智能体（WS CLI）

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Static inspection found a user-invoked CLI and standard-input MCP server, with no install hook or confirmed malicious behavior. The required agent-integration location only reads project-local AGENTS.md files for interactive session context.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs the interactive CLI or explicitly starts its MCP server.

Impact

No unconsented install-time execution, external agent-control mutation, credential harvesting, or destructive action was established.

Mechanism

The CLI reads local project instructions into its session context, while the MCP server receives JSON-RPC through standard input.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package metadata exposes a CLI and contains only a prepublish-only script, not an install lifecycle hook.
The CLI stops when standard input is not an interactive terminal before loading its runtime.
The flagged integration location reads project-local instruction files and returns their contents; it does not configure an external agent platform.
Those instructions are appended as a session system message during an interactive prompt flow.
The document MCP server processes JSON-RPC objects supplied on standard input.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 12 file(s), 992 KB of source, external domains: codeload.github.com, ejs.co, example.invalid, gist.githubusercontent.com, github.com, gobi-starweaver.cn, jimmy.warting.se, purl.oclc.org, react.dev, schemas.openxmlformats.org, stackoverflow.com, www.apache.org, www.libreoffice.org, www.w3.org, yargs.js.org

Source & flagged code

17 flagged

mcp/servers/doc-toolchain-server.jsView file

1436init_esbuild_shims(); L1437: import { spawn } from "node:child_process"; L1438: import * as fs2 from "node:fs";

High

Child Process

Package source references child process execution.

mcp/servers/doc-toolchain-server.jsView on unpkg · L1436

chunks/cli-main-SWZX52SE.jsView file

7stripAnsi, L8: writeStderrLine, L9: writeStdout, ... L19: __commonJS, L20: __dirname, L21: __export, ... L508: ]; L509: if (process.platform !== "win32") { L510: module2.exports.push( ... L1033: function formatProdErrorMessage(code) { L1034: var url2 = "https://react.dev/errors/" + code; L1035: if (1 < arguments.length) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

chunks/cli-main-SWZX52SE.jsView on unpkg · L7

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

chunks/cli-main-SWZX52SE.jsView on unpkg · L7

7Trigger-reachable chain: manifest.main -> cli.js -> chunks/cli-main-SWZX52SE.js L7: stripAnsi, L8: writeStderrLine, L9: writeStdout, ... L19: __commonJS, L20: __dirname, L21: __export, ... L508: ]; L509: if (process.platform !== "win32") { L510: module2.exports.push( ... L1033: function formatProdErrorMessage(code) { L1034: var url2 = "https://react.dev/errors/" + code; L1035: if (1 < arguments.length) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

chunks/cli-main-SWZX52SE.jsView on unpkg · L7

•matchType = previous_version_dangerous_delta matchedPackage = @gobi-starweaver/ws-cli@0.4.2 matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.4.2 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

chunks/cli-main-SWZX52SE.jsView on unpkg

53447const systemRoot = env4.SystemRoot ?? "C:\\Windows"; L53448: const powershell = path6.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"); L53449: const mediaDir = path6.win32.join(systemRoot, "Media");

High

Shell

Package source references shell execution.

chunks/cli-main-SWZX52SE.jsView on unpkg · L53447

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. chunks/cli-main-SWZX52SE.js: "Authorization", "Proxy-Authorization", get baseUrl() { return this.baseUrl?.origin; this[kProxyHeaders]["proxy-authorization"] = `Basic ${opts.auth}`; this[kProxyHeaders]["proxy-authorization"] = opts.token; this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString("base64")}`; const existProxyAuth = headers && Object.keys(headers).find((key) => key.toLowerCase() === "proxy-authorization");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

chunks/cli-main-SWZX52SE.jsView on unpkg

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

chunks/cli-main-SWZX52SE.jsView on unpkg · L7

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

chunks/cli-main-SWZX52SE.jsView on unpkg · L7

7Cross-file remote execution chain: chunks/cli-main-SWZX52SE.js spawns chunks/devtools-V5WI5QLO.js; helper contains network access plus dynamic code execution. L7: stripAnsi, L8: writeStderrLine, L9: writeStdout, ... L19: __commonJS, L20: __dirname, L21: __export, ... L508: ]; L509: if (process.platform !== "win32") { L510: module2.exports.push( ... L1033: function formatProdErrorMessage(code) { L1034: var url2 = "https://react.dev/errors/" + code; L1035: if (1 < arguments.length) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

chunks/cli-main-SWZX52SE.jsView on unpkg · L7

7Trigger-reachable credential exfiltration chain: manifest.main -> cli.js -> chunks/cli-main-SWZX52SE.js L7: stripAnsi, L8: writeStderrLine, L9: writeStdout, ... L19: __commonJS, L20: __dirname, L21: __export, ... L508: ]; L509: if (process.platform !== "win32") { L510: module2.exports.push( ... L1033: function formatProdErrorMessage(code) { L1034: var url2 = "https://react.dev/errors/" + code; L1035: if (1 < arguments.length) {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

chunks/cli-main-SWZX52SE.jsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

chunks/cli-main-SWZX52SE.jsView on unpkg

•path = chunks/cli-main-SWZX52SE.js kind = oversized_source_file sizeBytes = 5683717 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

chunks/cli-main-SWZX52SE.jsView on unpkg

•path = chunks/cli-main-SWZX52SE.js kind = oversized_cli_entrypoint sizeBytes = 5683717 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

chunks/cli-main-SWZX52SE.jsView on unpkg

cli.jsView file

5Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L5: stripAnsi, L6: writeStderrLine L7: } from "./chunks/chunk-7GEUHDQA.js"; ... L181: if (code <= 65535) { L182: return code >= 170 && nonASCIIidentifierStart.test(String.fromCharCode(code)); L183: } ... L239: keyword: ["break", "case", "catch", "continue", "debugger", "default", "do", "else", "finally", "for", "function", "if", "return", "switch", "throw", "try", "var", "const", "while"... L240: strict: ["implements", "interface", "let", "package", "private", "protected", "public", "static", "yield"], L241: strictBind: ["eval", "arguments"] ... L339: function isColorSupported() { L340: return typeof process === "object" && (process.e

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

cli.jsView on unpkg · L5

2565O.tracing = O.metrics = void 0; L2566: var U = __require("node:diagnostics_channel"); L2567: O.metrics = (0, U.channel)("lru-cache:metrics");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli.jsView on unpkg · L2565

vendor/vision-render/src/windows-job-runner.ps1View file

•path = vendor/vision-render/src/windows-job-runner.ps1 kind = build_helper sizeBytes = 11100 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/vision-render/src/windows-job-runner.ps1View on unpkg

Source & flagged code

17 flagged · loading source

mcp/servers/doc-toolchain-server.jsView file

1436init_esbuild_shims(); L1437: import { spawn } from "node:child_process"; L1438: import * as fs2 from "node:fs";

High

Child Process

Package source references child process execution.

mcp/servers/doc-toolchain-server.jsView on unpkg · L1436

chunks/cli-main-SWZX52SE.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

chunks/cli-main-SWZX52SE.jsView on unpkg · L7

Findings

4 Critical9 High7 Medium6 Low

CriticalCredential Exfiltrationchunks/cli-main-SWZX52SE.js

CriticalClipboard Crypto Hijackchunks/cli-main-SWZX52SE.js

CriticalTrigger Reachable Dangerous Capabilitychunks/cli-main-SWZX52SE.js

CriticalPrevious Version Dangerous Deltachunks/cli-main-SWZX52SE.js

HighChild Processmcp/servers/doc-toolchain-server.js

HighShellchunks/cli-main-SWZX52SE.js

HighEntrypoint Build Divergencecli.js

HighCredential Redirect Persistencechunks/cli-main-SWZX52SE.js

HighSandbox Evasion Gated Capabilitychunks/cli-main-SWZX52SE.js

HighObfuscated Payload Loaderchunks/cli-main-SWZX52SE.js

HighCross File Remote Execution Context

Affected versions and remediation

This report applies to @gobi-starweaver/ws-cli@0.4.5.

See all versions of @gobi-starweaver/ws-cli for other recorded verdicts.

Review the evidence and your use of @gobi-starweaver/ws-cli@0.4.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 04:55:37.625Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.