registry / @goldskycom/cli / 13.10.2
@goldskycom/cli@13.10.2
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no registry install hook, and the suspicious shell behavior is an interactive, feature-specific installer. Inspection found no credential theft, hidden remote payload execution, or persistence chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the Turbo CLI feature and accepts its prompt.
Impact
The accepted installer can modify the user's environment, but this is not automatic during npm installation.
Mechanism
Interactive download-and-shell installation of a related CLI binary.
AI rationale
The package has no registry install hook, and the suspicious shell behavior is an interactive, feature-specific installer. Inspection found no credential theft, hidden remote payload execution, or persistence chain.
Network endpoints1
install-turbo.goldsky.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest lists build and development scripts, with no install lifecycle hook.
- The CLI displays a Turbo installer prompt only after the Turbo command finds the binary missing.
Evidence against
- No install-time execution or self-dependency is declared.
- The remote shell installer is tied to an invoked CLI feature rather than package installation.
- The dynamic-evaluation matches are bundled third-party runtime code, not a remote payload loader.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
NoLicense
Oversized source lightweight scan
dist/index.js
Source & flagged code
12 flaggeddist/index.jsView file
1740`)}`,"error",n),n.message("Completing build...");let S=f.map(({id:_,chain:E,generated_subgraph_id:O})=>({id:_,chain:E,generated_bundle_id:O}));return[`${S.length} subgraph${S.lengt...
L1741: Wait a few minutes and use ${Df.default.bold("goldsky subgraph list")} to check the status of your deployments.`,"cancel",S):p0(`${E.error}: ${E.message} (${E.statusCode})`,"error"...
L1742: ${ub.default.goldsky.purple.bold((0,Pv.resolve)(qn.targetPath))}`,ub.default.goldsky.orange.bold("Target path")),!i&&!await Xu(qn.targetPath)&&(await Hg({message:`Target path '${qn...
...
L1749:
L1750: `)}}function ae(qn,df=!1){let Wf=(qn||"").split(",").map(Xu=>Xu.trim());return df?Wf:Wf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1751: --host ${e.url.su
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L17401Trigger-reachable chain: manifest.main -> dist/index.js
L1: "use strict";var qKe=Object.create;var MI=Object.defineProperty;var GKe=Object.getOwnPropertyDescriptor;var VKe=Object.getOwnPropertyNames;var zKe=Object.getPrototypeOf,HKe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function wfe(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=gYe(t,i,n,s)),n+t+i},E7,Rfe=(e,...t)=>{let[r]=t;if(!tj(r)||!tj(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Eh.DEFAULT_CONTENT_TYPE="application/octet-stream";Eh.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=RK.prototype.append.bind
Findings
2 Critical8 High3 Medium6 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumDynamic Requiredist/index.js
MediumEnvironment Vars
Affected versions and remediation
This report applies to @goldskycom/cli@13.10.2.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.10.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.