registry / @goldskycom/cli / 13.17.0
@goldskycom/cli@13.17.0
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 28d ago · by lpm-firewall-aiSource inspection found expected CLI authentication and user-invoked dataset synchronization behavior. The scanner’s dynamic-code and credential indicators include bundled dependencies and package-aligned functionality; the inspected source did not establish a concrete attack surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes login or an indexed.xyz sync command.
Impact
The inspected excerpts do not establish credential theft, remote code execution, or another attack effect.
Mechanism
Login exchanges credentials with the configured Goldsky API host; sync code configures an S3 client for the indexed.xyz feature.
AI rationale
Source inspection found expected CLI authentication and user-invoked dataset synchronization behavior. The scanner’s dynamic-code and credential indicators include bundled dependencies and package-aligned functionality; the inspected source did not establish a concrete attack surface.
Evidence
dist/index.js
Network endpoints1
ed5d915e0259fcddb2ab1ce5592040c3.r2.cloudflarestorage.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as Goldsky’s CLI, points to dist/index.js, and declares no install lifecycle scripts.
- The login flow sends its authorization request to the configured Goldsky API host and uses a local callback with state and a code challenge.
- The indexed.xyz sync code uses credentials for a Cloudflare R2 endpoint while providing a user-invoked data synchronization feature.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
15 flaggeddist/index.jsView file
1877L1878: `)}}}function lJe(e){let t=Math.floor(e);if(t<60)return Cf.default.dim(`00:${t<10?"0":""}${t}`);let r=Math.floor(t/60),n=t-r*60;return Cf.default.dim(`${r<10?"0":""}${r}:${n<10?"0"...
L1879: [ERROR]`),U),o.message(Cf.default.goldsky.red(O))});if(v){let O=await i(o,`abis/${f.normalizedName}.json`,JSON.stringify(v,null,2));c.add(O),g.abi=await xj(O)}else{o.message("Unabl...
...
L1891:
L1892: `)}}function ae(qn,df=!1){let Kf=(qn||"").split(",").map(Ap=>Ap.trim());return df?Kf:Kf.filter(Boolean)}function ft(qn){return qn.length<=2?qn.join(" and "):[qn.slice(0,-1).join(",...
L1893: The ${wj.default.bold("turbo")} binary is not installed.
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L18771Trigger-reachable chain: manifest.main -> dist/index.js
L1: "use strict";var SQe=Object.create;var fN=Object.defineProperty;var xQe=Object.getOwnPropertyDescriptor;var _Qe=Object.getOwnPropertyNames;var vQe=Object.getPrototypeOf,EQe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Vme(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=WQe(t,i,n,s)),n+t+i},pW,Qme=(e,...t)=>{let[r]=t;if(!Pj(r)||!Pj(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="application/octet-stream";Ch.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=SY.prototype.append.bind
Critical
Findings
2 Critical11 High4 Medium6 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
Affected versions and remediation
This report applies to @goldskycom/cli@13.17.0.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.17.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.