registry / @goldskycom/cli / 13.13.2
@goldskycom/cli@13.13.2
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no install lifecycle scripts and no self-dependency. The scanner's claimed remote decode-and-execute behavior is not supported by the inspected bundle; the matching R2 code downloads dataset files for a named CLI sync feature.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit execution of Goldsky CLI commands, including optional extension installation.
Impact
No unconsented install-time execution, credential redirection, or payload execution was confirmed.
Mechanism
User-directed API, data-sync, telemetry, and optional extension operations.
AI rationale
The package has no install lifecycle scripts and no self-dependency. The scanner's claimed remote decode-and-execute behavior is not supported by the inspected bundle; the matching R2 code downloads dataset files for a named CLI sync feature.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No install lifecycle hook or runtime self-dependency is declared.
- The bundled CLI's shell-based installers are reached only through explicit turbo or compose install commands.
Evidence against
- The bundle includes standard CLI network, telemetry, file, and subprocess features.
- The Cloudflare R2 endpoint is used as an S3 data source for an explicit indexed-data sync command, not as decoded executable code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
13 flaggeddist/index.jsView file
1817L1818: `)}}}function _Ke(e){let t=Math.floor(e);if(t<60)return Cf.default.dim(`00:${t<10?"0":""}${t}`);let r=Math.floor(t/60),n=t-r*60;return Cf.default.dim(`${r<10?"0":""}${r}:${n<10?"0"...
L1819: [ERROR]`),U),o.message(Cf.default.goldsky.red(O))});if(v){let O=await i(o,`abis/${f.normalizedName}.json`,JSON.stringify(v,null,2));c.add(O),g.abi=await lj(O)}else{o.message("Unabl...
...
L1831:
L1832: `)}}function ae(qn,df=!1){let Kf=(qn||"").split(",").map(Zu=>Zu.trim());return df?Kf:Kf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1833: The ${hj.default.bold("turbo")} binary is not installed.
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L18171Trigger-reachable chain: manifest.main -> dist/index.js
L1: "use strict";var UJe=Object.create;var aN=Object.defineProperty;var qJe=Object.getOwnPropertyDescriptor;var GJe=Object.getOwnPropertyNames;var VJe=Object.getPrototypeOf,zJe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Eme(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=hQe(t,i,n,s)),n+t+i},J7,Rme=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="application/octet-stream";Ch.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=iY.prototype.append.bind
Critical
Findings
2 Critical9 High4 Medium6 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumDynamic Require
Affected versions and remediation
This report applies to @goldskycom/cli@13.13.2.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.