registry / @goldskycom/cli / 13.13.1
@goldskycom/cli@13.13.1
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a normal bundled CLI with no registry-install lifecycle hook. Static alerts largely match bundled dependencies; the remaining remote installer is explicit and prompted.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No automatic trigger; the installer requires an explicit Turbo command and confirmation.
Impact
No confirmed malicious impact.
Mechanism
No confirmed malicious mechanism.
AI rationale
This is a normal bundled CLI with no registry-install lifecycle hook. Static alerts largely match bundled dependencies; the remaining remote installer is explicit and prompted.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI offers an optional remote Turbo installer after an interactive confirmation.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The executable only loads the bundled CLI entrypoint.
- The flagged eval, Function, and decoding uses are bundled third-party library code, not a remote payload loader.
- No credential harvesting, secret exfiltration, persistence, or automatic destructive action was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
13 flaggeddist/index.jsView file
1817L1818: `)}}}function xKe(e){let t=Math.floor(e);if(t<60)return Cf.default.dim(`00:${t<10?"0":""}${t}`);let r=Math.floor(t/60),n=t-r*60;return Cf.default.dim(`${r<10?"0":""}${r}:${n<10?"0"...
L1819: [ERROR]`),U),o.message(Cf.default.goldsky.red(O))});if(v){let O=await i(o,`abis/${f.normalizedName}.json`,JSON.stringify(v,null,2));c.add(O),g.abi=await lj(O)}else{o.message("Unabl...
...
L1831:
L1832: `)}}function ae(qn,df=!1){let Kf=(qn||"").split(",").map(Zu=>Zu.trim());return df?Kf:Kf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1833: The ${hj.default.bold("turbo")} binary is not installed.
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L18171Trigger-reachable chain: manifest.main -> dist/index.js
L1: "use strict";var MJe=Object.create;var aN=Object.defineProperty;var UJe=Object.getOwnPropertyDescriptor;var qJe=Object.getOwnPropertyNames;var GJe=Object.getPrototypeOf,VJe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Eme(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=mQe(t,i,n,s)),n+t+i},J7,Rme=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="application/octet-stream";Ch.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=iY.prototype.append.bind
Critical
Findings
2 Critical9 High4 Medium6 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumDynamic Require
Affected versions and remediation
This report applies to @goldskycom/cli@13.13.1.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.13.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.