registry / @goldskycom/cli / 13.11.0
@goldskycom/cli@13.11.0
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner findings are largely explained by bundled dependencies and normal CLI functionality. Source inspection found no lifecycle hook, secret harvesting, hidden payload execution, or automatic persistence.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the Turbo command and confirms installation.
Impact
The confirmed behavior is user-authorized command execution, not automatic package-install compromise.
Mechanism
Interactive installation of a same-vendor CLI extension.
AI rationale
The scanner findings are largely explained by bundled dependencies and normal CLI functionality. Source inspection found no lifecycle hook, secret harvesting, hidden payload execution, or automatic persistence.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest contains no npm install lifecycle hook.
- The executable only loads the bundled CLI when the user runs goldsky.
- The remote Turbo installer is a user-invoked CLI feature that displays installation instructions and asks for confirmation before execution.
Evidence against
- The bundled CLI includes a remote shell installer for its Turbo feature.
- The CLI sends opt-out-capable anonymous telemetry during CLI use.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
13 flaggeddist/index.jsView file
1750L1751: `)}}}function bWe(e){let t=Math.floor(e);if(t<60)return Cf.default.dim(`00:${t<10?"0":""}${t}`);let r=Math.floor(t/60),n=t-r*60;return Cf.default.dim(`${r<10?"0":""}${r}:${n<10?"0"...
L1752: [ERROR]`),U),o.message(Cf.default.goldsky.red(O))});if(v){let O=await i(o,`abis/${f.normalizedName}.json`,JSON.stringify(v,null,2));c.add(O),g.abi=await rj(O)}else{o.message("Unabl...
...
L1764:
L1765: `)}}function ae(qn,df=!1){let Kf=(qn||"").split(",").map(Xu=>Xu.trim());return df?Kf:Kf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1766: The ${cj.default.bold("turbo")} binary is not installed.
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L17501Trigger-reachable chain: manifest.main -> dist/index.js
L1: "use strict";var LYe=Object.create;var QI=Object.defineProperty;var jYe=Object.getOwnPropertyDescriptor;var MYe=Object.getOwnPropertyNames;var UYe=Object.getPrototypeOf,qYe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function ume(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=dJe(t,i,n,s)),n+t+i},G7,yme=(e,...t)=>{let[r]=t;if(!gj(r)||!gj(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Eh.DEFAULT_CONTENT_TYPE="application/octet-stream";Eh.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=QK.prototype.append.bind
Critical
Findings
2 Critical9 High4 Medium6 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumDynamic Require
Affected versions and remediation
This report applies to @goldskycom/cli@13.11.0.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.