registry / @goldskycom/cli / 13.15.1
@goldskycom/cli@13.15.1
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the only remote shell installation path inspected is interactive and user-invoked. No concrete malicious behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No malicious trigger was identified; the optional Turbo installer is reached through a CLI command and confirmation prompt.
Impact
No unconsented install-time execution, credential exfiltration, persistence, or destructive behavior was established.
Mechanism
The inspected code performs ordinary CLI update checking and, after confirmation, can invoke a vendor Turbo installer.
AI rationale
The package has no install lifecycle hook, and the only remote shell installation path inspected is interactive and user-invoked. No concrete malicious behavior was found.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata declares a CLI entrypoint and contains no install lifecycle hook.
- The inspected command implementation checks for a Turbo update by reading a version response.
- Turbo installation is displayed and requires an interactive confirmation before a shell command is spawned.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
16 flaggeddist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: "use strict";var YJe=Object.create;var cN=Object.defineProperty;var JJe=Object.getOwnPropertyDescriptor;var QJe=Object.getOwnPropertyNames;var XJe=Object.getPrototypeOf,ZJe=Object....
L2: `:`
...
L4: `,i)}while(n!==-1);return s+=e.substr(i),s};Eme.exports={stringReplaceAll:mQe,stringEncaseCRLFWithFirstIndex:hQe}});var Tme=D((b_r,Ome)=>{"use strict";var gQe=/(?:\\(u(?:[a-f\d]{4}...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Ame(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=EQe(t,i,n,s)),n+t+i},eW,Nme=(e,...t)=>{let[r]=t;if(!Aj(r)||!Aj(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];fo
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L11876L1877: `)}}}function DKe(e){let t=Math.floor(e);if(t<60)return Cf.default.dim(`00:${t<10?"0":""}${t}`);let r=Math.floor(t/60),n=t-r*60;return Cf.default.dim(`${r<10?"0":""}${r}:${n<10?"0"...
L1878: [ERROR]`),U),o.message(Cf.default.goldsky.red(O))});if(v){let O=await i(o,`abis/${f.normalizedName}.json`,JSON.stringify(v,null,2));c.add(O),g.abi=await dj(O)}else{o.message("Unabl...
...
L1890:
L1891: `)}}function ae(qn,df=!1){let Kf=(qn||"").split(",").map(Ap=>Ap.trim());return df?Kf:Kf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1892: The ${Sj.default.bold("turbo")} binary is not installed.
Critical
Findings
3 Critical11 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
Affected versions and remediation
This report applies to @goldskycom/cli@13.15.1.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.15.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.