registry / @goldskycom/cli / 13.13.3
@goldskycom/cli@13.13.3
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe high-risk scanner matches resolve to ordinary CLI telemetry and an explicitly interactive extension installer, not an automatic malicious chain. There are no registry install hooks or confirmed payload execution, credential exfiltration, or broad project mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running CLI commands; the installer requires the turbo subcommand and confirmation.
Impact
May transmit anonymous telemetry or install a requested Goldsky extension; no unconsented credential theft or persistence was established.
Mechanism
Command telemetry and an interactive extension installer.
AI rationale
The high-risk scanner matches resolve to ordinary CLI telemetry and an explicitly interactive extension installer, not an automatic malicious chain. There are no registry install hooks or confirmed payload execution, credential exfiltration, or broad project mutation.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The CLI sends anonymous usage telemetry after command execution, including system characteristics and command events.
- The user-invoked turbo command offers to run a remote shell installer after an interactive confirmation.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The remote installer is reachable only through the turbo subcommand and asks before spawning it.
- Telemetry clears authentication before posting and removes token arguments from recorded commands.
- No self-dependency, hidden payload execution, credential harvesting, or foreign control-surface mutation was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
14 flaggeddist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: "use strict";var zJe=Object.create;var oN=Object.defineProperty;var HJe=Object.getOwnPropertyDescriptor;var WJe=Object.getOwnPropertyNames;var KJe=Object.getPrototypeOf,YJe=Object....
L2: `:`
...
L4: `,i)}while(n!==-1);return s+=e.substr(i),s};Sme.exports={stringReplaceAll:uQe,stringEncaseCRLFWithFirstIndex:pQe}});var Cme=D((o_r,wme)=>{"use strict";var dQe=/(?:\\(u(?:[a-f\d]{4}...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Eme(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=SQe(t,i,n,s)),n+t+i},Y7,Rme=(e,...t)=>{let[r]=t;if(!Ej(r)||!Ej(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];fo
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L11817L1818: `)}}}function vKe(e){let t=Math.floor(e);if(t<60)return Cf.default.dim(`00:${t<10?"0":""}${t}`);let r=Math.floor(t/60),n=t-r*60;return Cf.default.dim(`${r<10?"0":""}${r}:${n<10?"0"...
L1819: [ERROR]`),U),o.message(Cf.default.goldsky.red(O))});if(v){let O=await i(o,`abis/${f.normalizedName}.json`,JSON.stringify(v,null,2));c.add(O),g.abi=await cj(O)}else{o.message("Unabl...
...
L1831:
L1832: `)}}function ae(qn,df=!1){let Kf=(qn||"").split(",").map(Zu=>Zu.trim());return df?Kf:Kf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1833: The ${hj.default.bold("turbo")} binary is not installed.
Critical
Findings
3 Critical9 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
High
Affected versions and remediation
This report applies to @goldskycom/cli@13.13.3.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.13.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.