registry / @goldskycom/cli / 13.10.1
@goldskycom/cli@13.10.1
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package has no npm install lifecycle hook, and inspection did not confirm the scanner's claimed payload decoding or credential redirection. The observed shell-pipe installer is reachable through explicit CLI functionality rather than automatically on installation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a relevant Goldsky CLI command and elects to install or update an extension.
Impact
Remote installer behavior should be evaluated as normal CLI supply-chain risk, but no covert package-install attack was found.
Mechanism
User-invoked extension installation and update support.
AI rationale
This package has no npm install lifecycle hook, and inspection did not confirm the scanner's claimed payload decoding or credential redirection. The observed shell-pipe installer is reachable through explicit CLI functionality rather than automatically on installation.
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The bundled CLI includes a displayed shell-pipe update command.
- The package has no install lifecycle hook.
Evidence against
- The shell command is presented by a user-invoked CLI update path, not package installation.
- No source evidence showed credential harvesting, covert exfiltration, or agent-control changes.
- The scanner's claimed decoded remote execution was not confirmed in the inspected entrypoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
13 flaggeddist/index.jsView file
1740`)}`,"error",n),n.message("Completing build...");let S=f.map(({id:_,chain:E,generated_subgraph_id:O})=>({id:_,chain:E,generated_bundle_id:O}));return[`${S.length} subgraph${S.lengt...
L1741: Wait a few minutes and use ${Df.default.bold("goldsky subgraph list")} to check the status of your deployments.`,"cancel",S):p0(`${E.error}: ${E.message} (${E.statusCode})`,"error"...
L1742: ${ub.default.goldsky.purple.bold((0,Pv.resolve)(qn.targetPath))}`,ub.default.goldsky.orange.bold("Target path")),!i&&!await Xu(qn.targetPath)&&(await Hg({message:`Target path '${qn...
...
L1749:
L1750: `)}}function ae(qn,df=!1){let Wf=(qn||"").split(",").map(Xu=>Xu.trim());return df?Wf:Wf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1751: --host ${e.url.su
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L17401Trigger-reachable chain: manifest.main -> dist/index.js
L1: "use strict";var LKe=Object.create;var jI=Object.defineProperty;var jKe=Object.getOwnPropertyDescriptor;var MKe=Object.getOwnPropertyNames;var UKe=Object.getPrototypeOf,qKe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Sfe(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=dYe(t,i,n,s)),n+t+i},_7,Dfe=(e,...t)=>{let[r]=t;if(!ej(r)||!ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Eh.DEFAULT_CONTENT_TYPE="application/octet-stream";Eh.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=TK.prototype.append.bind
Findings
2 Critical9 High4 Medium6 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumDynamic Require
Affected versions and remediation
This report applies to @goldskycom/cli@13.10.1.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.10.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.