registry / @goldskycom/cli / 13.16.0
@goldskycom/cli@13.16.0
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe inspected source shows an ordinary Goldsky CLI login flow and no install lifecycle hook. Scanner hints about bundled dynamic code and network behavior do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the Goldsky CLI login flow or an authenticated command.
Impact
No confirmed attack surface was established.
Mechanism
A supplied token is checked against the configured Goldsky API host and stored for later CLI use.
AI rationale
The inspected source shows an ordinary Goldsky CLI login flow and no install lifecycle hook. Scanner hints about bundled dynamic code and network behavior do not establish malicious behavior.
Evidence
.goldsky/auth_token
Decision evidence
public snapshotAI called this Clean at 77.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install lifecycle hook; its scripts are development and build tasks.
- The CLI validates a supplied token through its configured Goldsky API host and saves it locally after successful validation.
- The CLI loads its saved token from the Goldsky config directory for authenticated use.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
15 flaggeddist/index.jsView file
1877L1878: `)}}}function ZYe(e){let t=Math.floor(e);if(t<60)return Cf.default.dim(`00:${t<10?"0":""}${t}`);let r=Math.floor(t/60),n=t-r*60;return Cf.default.dim(`${r<10?"0":""}${r}:${n<10?"0"...
L1879: [ERROR]`),U),o.message(Cf.default.goldsky.red(O))});if(v){let O=await i(o,`abis/${f.normalizedName}.json`,JSON.stringify(v,null,2));c.add(O),g.abi=await bj(O)}else{o.message("Unabl...
...
L1891:
L1892: `)}}function ae(qn,df=!1){let Kf=(qn||"").split(",").map(Ap=>Ap.trim());return df?Kf:Kf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1893: The ${vj.default.bold("turbo")} binary is not installed.
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L18771Trigger-reachable chain: manifest.main -> dist/index.js
L1: "use strict";var lQe=Object.create;var pN=Object.defineProperty;var uQe=Object.getOwnPropertyDescriptor;var pQe=Object.getOwnPropertyNames;var dQe=Object.getPrototypeOf,fQe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Lme(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=FQe(t,i,n,s)),n+t+i},cW,zme=(e,...t)=>{let[r]=t;if(!Rj(r)||!Rj(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="application/octet-stream";Ch.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=gY.prototype.append.bind
Critical
Findings
2 Critical11 High4 Medium6 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
Affected versions and remediation
This report applies to @goldskycom/cli@13.16.0.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.