registry / @goldskycom/cli / 13.15.0
@goldskycom/cli@13.15.0
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no lifecycle hook, credential exfiltration, persistence, or concrete malicious behavior. Network activity is package-aligned service and anonymous telemetry activity.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running a Goldsky CLI command.
Impact
No malicious impact was identified from the inspected source.
Mechanism
The CLI sends service requests and optional anonymous telemetry to Goldsky endpoints; no install-time execution was found.
AI rationale
Static inspection found no lifecycle hook, credential exfiltration, persistence, or concrete malicious behavior. Network activity is package-aligned service and anonymous telemetry activity.
Network endpoints2
api.goldsky.com/api/public/telemetry/v1/cli
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI entrypoint and contains build-related scripts, with no install lifecycle hook.
- The CLI defaults its API host to the Goldsky API or a local development address.
- Telemetry uses an anonymous identifier, clears authentication, and supports disabling before sending to the Goldsky public telemetry route.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
16 flaggeddist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: "use strict";var KJe=Object.create;var cN=Object.defineProperty;var YJe=Object.getOwnPropertyDescriptor;var JJe=Object.getOwnPropertyNames;var QJe=Object.getPrototypeOf,XJe=Object....
L2: `:`
...
L4: `,i)}while(n!==-1);return s+=e.substr(i),s};vme.exports={stringReplaceAll:fQe,stringEncaseCRLFWithFirstIndex:mQe}});var Ome=D((g_r,Ame)=>{"use strict";var hQe=/(?:\\(u(?:[a-f\d]{4}...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Dme(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=vQe(t,i,n,s)),n+t+i},Z7,Ime=(e,...t)=>{let[r]=t;if(!Dj(r)||!Dj(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];fo
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L11877L1878: `)}}}function CKe(e){let t=Math.floor(e);if(t<60)return Cf.default.dim(`00:${t<10?"0":""}${t}`);let r=Math.floor(t/60),n=t-r*60;return Cf.default.dim(`${r<10?"0":""}${r}:${n<10?"0"...
L1879: [ERROR]`),U),o.message(Cf.default.goldsky.red(O))});if(v){let O=await i(o,`abis/${f.normalizedName}.json`,JSON.stringify(v,null,2));c.add(O),g.abi=await pj(O)}else{o.message("Unabl...
...
L1891:
L1892: `)}}function ae(qn,df=!1){let Kf=(qn||"").split(",").map(Ap=>Ap.trim());return df?Kf:Kf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1893: The ${bj.default.bold("turbo")} binary is not installed.
Critical
Findings
3 Critical11 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
Affected versions and remediation
This report applies to @goldskycom/cli@13.15.0.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.