registry / @goldskycom/cli / 13.15.2
@goldskycom/cli@13.15.2
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe source inspection supports normal Goldsky CLI authentication and API use; scanner matches such as eval and metadata endpoints appear in bundled dependencies. No concrete attack behavior was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the CLI’s login or authenticated commands.
Impact
No unrelated credential recipient or malicious behavior was established in the inspected source.
Mechanism
The login flow exchanges an authorization code with the configured API host and validates the token through that host.
AI rationale
The source inspection supports normal Goldsky CLI authentication and API use; scanner matches such as eval and metadata endpoints appear in bundled dependencies. No concrete attack behavior was established.
Evidence
package.jsondist/index.js
Network endpoints1
api.goldsky.com
Decision evidence
public snapshotAI called this Clean at 81.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies a Goldsky CLI and points its main entrypoint to dist/index.js.
- The bundled CLI defaults to Goldsky’s API host, with a local development fallback.
- The login flow exchanges an authorization code with the selected API host and checks the returned token there.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
16 flaggeddist/index.jsView file
1Source sends the broad process environment to a literal external destination.
L1: "use strict";var ZJe=Object.create;var lN=Object.defineProperty;var eQe=Object.getOwnPropertyDescriptor;var tQe=Object.getOwnPropertyNames;var rQe=Object.getPrototypeOf,nQe=Object....
L2: `:`
...
L4: `,i)}while(n!==-1);return s+=e.substr(i),s};Ame.exports={stringReplaceAll:bQe,stringEncaseCRLFWithFirstIndex:SQe}});var Ime=D((D_r,Pme)=>{"use strict";var xQe=/(?:\\(u(?:[a-f\d]{4}...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function kme(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=AQe(t,i,n,s)),n+t+i},nW,Lme=(e,...t)=>{let[r]=t;if(!Oj(r)||!Oj(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];fo
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L11877L1878: `)}}}function HYe(e){let t=Math.floor(e);if(t<60)return Cf.default.dim(`00:${t<10?"0":""}${t}`);let r=Math.floor(t/60),n=t-r*60;return Cf.default.dim(`${r<10?"0":""}${r}:${n<10?"0"...
L1879: [ERROR]`),U),o.message(Cf.default.goldsky.red(O))});if(v){let O=await i(o,`abis/${f.normalizedName}.json`,JSON.stringify(v,null,2));c.add(O),g.abi=await gj(O)}else{o.message("Unabl...
...
L1891:
L1892: `)}}function ae(qn,df=!1){let Kf=(qn||"").split(",").map(Ap=>Ap.trim());return df?Kf:Kf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1893: The ${xj.default.bold("turbo")} binary is not installed.
Critical
Findings
3 Critical11 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
Affected versions and remediation
This report applies to @goldskycom/cli@13.15.2.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.15.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.