@goldskycom/cli@13.17.1
The Goldsky CLI to deploy subgraphs, index & transform blockchain data, configure webhooks, and access your data in real-time.
AI Security Review
scanned 19d ago · by lpm-firewall-aiSource inspection confirms a reachable shell command injection risk in decoded-log synchronization. The path requires a user-supplied address, so this supports a warning for remote code execution risk rather than a package block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run decoded-log sync with a crafted contract address, either as an option or at the interactive prompt.
Impact
Shell commands may run with the privileges of the CLI user.
Mechanism
The package inserts the address into a command string and executes it through child_process.execSync.
AI rationale
Source inspection confirms a reachable shell command injection risk in decoded-log synchronization. The path requires a user-supplied address, so this supports a warning for remote code execution risk rather than a package block.
Evidence
dist/index.js
Decision evidence
public snapshotAI called this Suspicious at 98.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI entrypoint through bin/goldsky, which loads dist/index.js.
- The decoded-log sync command accepts a contract address and passes it to a file-processing callback.
- That callback interpolates the address into a shell command executed with execSync without escaping shell syntax.
Evidence against
- The risky path is activated by the decoded-log sync command with a supplied contract address; the inspected manifest has no install lifecycle hooks.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
15 flaggeddist/index.jsView file
1821`)}var iPt=[Bh.default.bold("Cache behavior"),` ${Bh.default.green("cached")} block by height/hash, tx by hash, receipts, bounded eth_getLogs`,` ${Bh.default.dim("forwarded")...
L1822: `);async function FC(){let e=await Wte();if(e.boost===null)throw new Error("Boost is not reachable right now");return e.boost}async function eP(){let[e,t]=await Zn.get(`${Hy}/chain...
L1823:
...
L1831: Arguments:
L1832: version Version to update to (default: "stable"). Accepts "stable", "latest", or a semver version.`)}function VPt(e,t){let r=MPt(t);UPt(e,r)}function zPt(e,t){let r=O6(D6(e));uIe(...
L1833: Install with: ${lIe.default.cyan.bold(`goldsky ${e.name} install`)}`),process.exit(1));let c=FPt(e,s);if(c===0&&ere()){let l=XPt(e);l&&ZPt(e.name,l.current,l.latest)}c!==0&&process...
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L18211Trigger-reachable chain: manifest.main -> dist/index.js
L1: "use strict";var AQe=Object.create;var fN=Object.defineProperty;var TQe=Object.getOwnPropertyDescriptor;var RQe=Object.getOwnPropertyNames;var kQe=Object.getPrototypeOf,PQe=Object....
L2: `:`
...
L5: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Wme(e){let t=e[0]==="u",r=e[1]==="{";return t&&!r&&e.length===5...
L6: `);return s!==-1&&(t=rXe(t,i,n,s)),n+t+i},uW,ehe=(e,...t)=>{let[r]=t;if(!Ij(r)||!Ij(r.raw))return t.join(" ");let n=t.slice(1),i=[r.raw[0]];for(let s=1;s<r.length;s++)i.push(String...
L7: `;Ch.DEFAULT_CONTENT_TYPE="application/octet-stream";Ch.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var n=bY.prototype.append.bind
Findings
2 Critical11 High4 Medium6 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighEvaldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCloud Metadata Accessdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
Affected versions and remediation
This report applies to @goldskycom/cli@13.17.1.
See all versions of @goldskycom/cli for other recorded verdicts.
- Review the evidence and your use of @goldskycom/cli@13.17.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.