registry / @gobi-starweaver/ws-cli / 0.4.8

@gobi-starweaver/ws-cli@0.4.8

北辰计划·望舒 Polaris·WS — 面向史学与人文研究的终端智能体（WS CLI）

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Source inspection found no install-time execution hook or confirmed malicious behavior. The flagged clipboard code is consistent with interactive CLI functionality, and the fixture path constructs synthetic test data.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running the CLI interactively; clipboard helpers are used by CLI features.

Impact

No unsolicited credential transfer, wallet replacement, or other concrete attack effect was established.

Mechanism

The executable checks for a TTY before loading the interactive bundle. Clipboard helpers invoke operating-system clipboard commands.

AI rationale

Evidence

package.jsoncli.jschunks/cli-main-ETGWINUI.jschunks/chunk-HLZ6YS22.jsmcp/servers/doc-toolchain-server.jsvendor/hj_corpus/tests/build_fixture.py

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes cli.js as the executable and has only a prepublishOnly script, with no install hook.
cli.js loads the interactive bundle only after confirming the process has a TTY.
The flagged bundle chunk contains ordinary bundled dependency code.
Clipboard reading is implemented through platform clipboard commands.
Clipboard writing is used to copy a diagnostic bundle at an explicit call site.
The cited document-toolchain code extracts text and assembles document blocks.
The flagged Python file builds a synthetic SQLite test fixture.

Evidence against

Clipboard access and network references alone do not establish wallet replacement, credential theft, or another unsolicited action; inspected clipboard use is consistent with CLI functionality.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

17 flagged

mcp/servers/doc-toolchain-server.jsView file

1470init_esbuild_shims(); L1471: import { spawn } from "node:child_process"; L1472: import * as fs2 from "node:fs";

High

Child Process

Package source references child process execution.

mcp/servers/doc-toolchain-server.jsView on unpkg · L1470

chunks/cli-main-ETGWINUI.jsView file

8stripAnsi, L9: writeStderrLine, L10: writeStdout, ... L20: __commonJS, L21: __dirname, L22: __export, ... L509: ]; L510: if (process.platform !== "win32") { L511: module2.exports.push( ... L1034: function formatProdErrorMessage(code) { L1035: var url2 = "https://react.dev/errors/" + code; L1036: if (1 < arguments.length) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

chunks/cli-main-ETGWINUI.jsView on unpkg · L8

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

chunks/cli-main-ETGWINUI.jsView on unpkg · L8

8Trigger-reachable chain: manifest.main -> cli.js -> chunks/cli-main-ETGWINUI.js L8: stripAnsi, L9: writeStderrLine, L10: writeStdout, ... L20: __commonJS, L21: __dirname, L22: __export, ... L509: ]; L510: if (process.platform !== "win32") { L511: module2.exports.push( ... L1034: function formatProdErrorMessage(code) { L1035: var url2 = "https://react.dev/errors/" + code; L1036: if (1 < arguments.length) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

chunks/cli-main-ETGWINUI.jsView on unpkg · L8

63304"System32", L63305: "WindowsPowerShell", L63306: "v1.0",

High

Shell

Package source references shell execution.

chunks/cli-main-ETGWINUI.jsView on unpkg · L63304

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. chunks/cli-main-ETGWINUI.js: "Authorization", "Proxy-Authorization", get baseUrl() { return this.baseUrl?.origin; this[kProxyHeaders]["proxy-authorization"] = `Basic ${opts.auth}`; this[kProxyHeaders]["proxy-authorization"] = opts.token; this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString("base64")}`; const existProxyAuth = headers && Object.keys(headers).find((key) => key.toLowerCase() === "proxy-authorization");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

chunks/cli-main-ETGWINUI.jsView on unpkg

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

chunks/cli-main-ETGWINUI.jsView on unpkg · L8

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

chunks/cli-main-ETGWINUI.jsView on unpkg · L8

8Cross-file remote execution chain: chunks/cli-main-ETGWINUI.js spawns chunks/chunk-HLZ6YS22.js; helper contains network access plus dynamic code execution. L8: stripAnsi, L9: writeStderrLine, L10: writeStdout, ... L20: __commonJS, L21: __dirname, L22: __export, ... L509: ]; L510: if (process.platform !== "win32") { L511: module2.exports.push( ... L1034: function formatProdErrorMessage(code) { L1035: var url2 = "https://react.dev/errors/" + code; L1036: if (1 < arguments.length) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

chunks/cli-main-ETGWINUI.jsView on unpkg · L8

8Trigger-reachable credential exfiltration chain: manifest.main -> cli.js -> chunks/cli-main-ETGWINUI.js L8: stripAnsi, L9: writeStderrLine, L10: writeStdout, ... L20: __commonJS, L21: __dirname, L22: __export, ... L509: ]; L510: if (process.platform !== "win32") { L511: module2.exports.push( ... L1034: function formatProdErrorMessage(code) { L1035: var url2 = "https://react.dev/errors/" + code; L1036: if (1 < arguments.length) {

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

chunks/cli-main-ETGWINUI.jsView on unpkg · L8

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

chunks/cli-main-ETGWINUI.jsView on unpkg

•path = chunks/cli-main-ETGWINUI.js kind = oversized_source_file sizeBytes = 6227391 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

chunks/cli-main-ETGWINUI.jsView on unpkg

•path = chunks/cli-main-ETGWINUI.js kind = oversized_cli_entrypoint sizeBytes = 6227391 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

chunks/cli-main-ETGWINUI.jsView on unpkg

chunks/chunk-HLZ6YS22.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gobi-starweaver/ws-cli@0.4.7 matchedIdentity = npm:QGdvYmktc3RhcndlYXZlci93cy1jbGk:0.4.7 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

chunks/chunk-HLZ6YS22.jsView on unpkg

2524O.tracing = O.metrics = void 0; L2525: var U = __require("node:diagnostics_channel"); L2526: O.metrics = (0, U.channel)("lru-cache:metrics");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

chunks/chunk-HLZ6YS22.jsView on unpkg · L2524

vendor/vision-render/src/windows-job-runner.ps1View file

•path = vendor/vision-render/src/windows-job-runner.ps1 kind = build_helper sizeBytes = 11100 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

vendor/vision-render/src/windows-job-runner.ps1View on unpkg

vendor/hj_corpus/tests/build_fixture.pyView file

•path = vendor/hj_corpus/tests/build_fixture.py kind = payload_in_excluded_dir sizeBytes = 5074 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

vendor/hj_corpus/tests/build_fixture.pyView on unpkg

Source & flagged code

17 flagged · loading source

mcp/servers/doc-toolchain-server.jsView file

1470init_esbuild_shims(); L1471: import { spawn } from "node:child_process"; L1472: import * as fs2 from "node:fs";

High

Child Process

Package source references child process execution.

mcp/servers/doc-toolchain-server.jsView on unpkg · L1470

chunks/cli-main-ETGWINUI.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

chunks/cli-main-ETGWINUI.jsView on unpkg · L8

Findings

4 Critical9 High7 Medium6 Low

CriticalCredential Exfiltrationchunks/cli-main-ETGWINUI.js

CriticalClipboard Crypto Hijackchunks/cli-main-ETGWINUI.js

CriticalTrigger Reachable Dangerous Capabilitychunks/cli-main-ETGWINUI.js

CriticalPrevious Version Dangerous Deltachunks/chunk-HLZ6YS22.js

HighChild Processmcp/servers/doc-toolchain-server.js

HighShellchunks/cli-main-ETGWINUI.js

HighCredential Redirect Persistencechunks/cli-main-ETGWINUI.js

HighSandbox Evasion Gated Capabilitychunks/cli-main-ETGWINUI.js

HighObfuscated Payload Loaderchunks/cli-main-ETGWINUI.js

HighCross File Remote Execution Contextchunks/cli-main-ETGWINUI.js

High

Affected versions and remediation

This report applies to @gobi-starweaver/ws-cli@0.4.8.

See all versions of @gobi-starweaver/ws-cli for other recorded verdicts.

Review the evidence and your use of @gobi-starweaver/ws-cli@0.4.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 16:32:56.226Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.