registry / @gobi-starweaver/ws-cli / 0.4.7

@gobi-starweaver/ws-cli@0.4.7

北辰计划·望舒 Polaris·WS — 面向史学与人文研究的终端智能体（WS CLI）

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Direct source inspection does not support the scanner’s clipboard-hijack or credential-exfiltration labels: clipboard use is user-triggered image attachment, and the saved portal token is restricted to the default portal or loopback destination. The manifest has no install hook, while engine setup is an on-demand document tool.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user presses Ctrl+V in the interactive CLI or explicitly calls a document-engine tool.

Impact

The inspected paths establish no unconsented credential exposure or unrelated system mutation.

Mechanism

The CLI attaches a clipboard image to the prompt; the document server can fetch rendering engines for document conversion.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines only a prepublishOnly script that exits with an error; it has no install lifecycle hook.
The clipboard path reads an image after Ctrl+V and attaches it to the prompt; it does not identify or rewrite cryptocurrency addresses.
Engine installation is an explicitly named document-tool MCP operation routed through tools/call.
The portal helper attaches a saved session token only for the package’s default portal or a loopback destination, then sends it to that selected destination.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 12 file(s), 1023 KB of source, external domains: codeload.github.com, ejs.co, example.invalid, gist.githubusercontent.com, github.com, gobi-starweaver.cn, jimmy.warting.se, purl.oclc.org, react.dev, schemas.openxmlformats.org, stackoverflow.com, www.apache.org, www.libreoffice.org, www.w3.org, yargs.js.org

Source & flagged code

17 flagged

mcp/servers/doc-toolchain-server.jsView file

Lines 1450-1490javascript

1450 }))

1451 ].sort((a, b) => b.start - a.start || a.kind - b.kind || b.seq - a.seq);

1452 let nextXml = documentXml;

1453 for (const edit of edits) {

1454 nextXml = nextXml.slice(0, edit.start) + edit.xml + nextXml.slice(edit.end);

1455 }

1456 const after = walkBody(parseXml(nextXml, "word/document.xml").tokens);

1457 const nextEntries = entries.map(

1458 (entry) => entry.name === "word/document.xml" ? { name: entry.name, data: Buffer.from(nextXml, "utf8") } : { name: entry.name, data: inflateZipEntry(entry) }

1459 );

1460 return {

1461 buffer: writeZip(nextEntries),

1462 applied: ops.length,

1463 paragraphCountBefore: walk.paragraphSpans.length,

1464 paragraphCountAfter: after.paragraphSpans.length

1465 };

1466}

1467__name(editDocx, "editDocx");

1468

1469// packages/core/src/mcp/servers/doc-toolchain/convert.ts

1470init_esbuild_shims();

1471import { spawn } from "node:child_process";

1472import * as fs2 from "node:fs";

High

Child Process

Package source references child process execution.

mcp/servers/doc-toolchain-server.jsView on unpkg · L1470

1473import * as os2 from "node:os";

1474import * as path3 from "node:path";

1475import { pathToFileURL } from "node:url";

1476

1477// packages/core/src/mcp/servers/doc-toolchain/portable-engine.ts

1478init_esbuild_shims();

1479import { createHash as createHash2 } from "node:crypto";

1480import * as fs from "node:fs";

1481import * as os from "node:os";

1482import * as path2 from "node:path";

1483import { Readable, Transform } from "node:stream";

1484import { pipeline } from "node:stream/promises";

1485import { setImmediate as yieldToEventLoop } from "node:timers/promises";

1486var ENGINE_DIR_ENV = "WS_ENGINE_DIR";

1487var ENGINE_MANIFEST_URL_ENV = "WS_ENGINE_MANIFEST_URL";

1488var ENGINE_AUTO_INSTALL_ENV = "WS_ENGINE_AUTO_INSTALL";

1489var DEFAULT_ENGINE_MANIFEST_URL = "https://gobi-starweaver.cn/dist/engines/manifest.json";

1490var MANIFEST_TIMEOUT_MS = 15e3;

•matchType = previous_version_dangerous_delta matchedPackage = @gobi-starweaver/ws-cli@0.4.5 matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.4.5 similarity = 0.929 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

mcp/servers/doc-toolchain-server.jsView on unpkg

chunks/cli-main-5JF6PNAS.jsView file

7stripAnsi, L8: writeStderrLine, L9: writeStdout, ... L19: __commonJS, L20: __dirname, L21: __export, ... L508: ]; L509: if (process.platform !== "win32") { L510: module2.exports.push( ... L1033: function formatProdErrorMessage(code) { L1034: var url2 = "https://react.dev/errors/" + code; L1035: if (1 < arguments.length) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

chunks/cli-main-5JF6PNAS.jsView on unpkg · L7

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

chunks/cli-main-5JF6PNAS.jsView on unpkg · L7

7Trigger-reachable chain: manifest.main -> cli.js -> chunks/cli-main-5JF6PNAS.js L7: stripAnsi, L8: writeStderrLine, L9: writeStdout, ... L19: __commonJS, L20: __dirname, L21: __export, ... L508: ]; L509: if (process.platform !== "win32") { L510: module2.exports.push( ... L1033: function formatProdErrorMessage(code) { L1034: var url2 = "https://react.dev/errors/" + code; L1035: if (1 < arguments.length) {

Critical

Trigger Reachable Dangerous Capability

cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import {

3 CLI_VERSION,

4 eastAsianWidth,

5 stripAnsi,

6 writeStderrLine

7} from "./chunks/chunk-YPTMNWVY.js";

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

cli.jsView on unpkg · L5

vendor/vision-render/src/windows-job-runner.ps1View file

•path = vendor/vision-render/src/windows-job-runner.ps1 kind = build_helper sizeBytes = 11100 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/vision-render/src/windows-job-runner.ps1View on unpkg

Source & flagged code

17 flagged · loading source

mcp/servers/doc-toolchain-server.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

mcp/servers/doc-toolchain-server.jsView on unpkg

1470init_esbuild_shims(); L1471: import { spawn } from "node:child_process"; L1472: import * as fs2 from "node:fs";

High

Child Process

Package source references child process execution.

mcp/servers/doc-toolchain-server.jsView on unpkg · L1470

chunks/cli-main-5JF6PNAS.jsView file

Findings

4 Critical9 High7 Medium6 Low

CriticalCredential Exfiltrationchunks/cli-main-5JF6PNAS.js

CriticalClipboard Crypto Hijackchunks/cli-main-5JF6PNAS.js

CriticalTrigger Reachable Dangerous Capabilitychunks/cli-main-5JF6PNAS.js

CriticalPrevious Version Dangerous Deltamcp/servers/doc-toolchain-server.js

HighChild Processmcp/servers/doc-toolchain-server.js

HighShellchunks/cli-main-5JF6PNAS.js

HighEntrypoint Build Divergencecli.js

HighCredential Redirect Persistencechunks/cli-main-5JF6PNAS.js

HighSandbox Evasion Gated Capabilitychunks/cli-main-5JF6PNAS.js

HighObfuscated Payload Loaderchunks/cli-main-5JF6PNAS.js

HighCross File Remote Execution Context

Affected versions and remediation

This report applies to @gobi-starweaver/ws-cli@0.4.7.

See all versions of @gobi-starweaver/ws-cli for other recorded verdicts.

Review the evidence and your use of @gobi-starweaver/ws-cli@0.4.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 01:36:58.250Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.