registry / @hithink-tech/hithink-finance-cli / 0.1.2

@hithink-tech/hithink-finance-cli@0.1.2

hithink finance CLI for humans, automation, and AI agents

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 75 file(s), 180 KB of source, external domains: fuyao.aicubes.cn, registry.npmjs.org

Source & flagged code

4 flagged

package.jsonView file

Lines 4-44json

4 "description": "hithink finance CLI for humans, automation, and AI agents",

5 "type": "module",

6 "bin": {

7 "hithink-finance": "./dist/cli/main.js"

8 },

9 "files": [

10 "dist",

11 "!dist/**/*.map",

12 "schemas",

13 "migrations",

14 "skills",

15 "scripts/postinstall.mjs",

16 "scripts/update-check.mjs",

17 "README.md",

18 "CHANGELOG.md",

19 "SECURITY.md"

20 ],

21 "scripts": {

22 "build": "tsc -p tsconfig.json",

23 "generate:contracts": "npm run build && node scripts/generate-contracts.mjs && prettier --write \"schemas/*.json\" \"skills/**/*.md\"",

24 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "pretest": "npm run build",

26 "test": "vitest run",

27 "typecheck": "tsc -p tsconfig.json --noEmit",

28 "lint": "eslint .",

29 "format": "prettier --check .",

30 "verify": "npm run format && npm run lint && npm run typecheck && npm run test && npm run build",

31 "prepublishOnly": "node scripts/check-license.mjs && npm run verify"

32 },

33 "engines": {

34 "node": ">=22.12.0"

35 },

36 "repository": {

37 "type": "git",

38 "url": "git+https://github.com/HiThink-Tech/Financial-API.git",

39 "directory": "hithink-finance-cli"

40 },

41 "publishConfig": {

42 "access": "public"

43 },

44 "license": "MIT",

dist/infrastructure/credentials/api-key-provider.jsView file

Lines 1-22javascript

1import { CliError } from '../../contracts/errors.js';

2const PROFILE_PREFIX = 'profile:';

3const API_KEY_RECOVERY_HINT = 'Get an API key at https://fuyao.aicubes.cn/admin, then run `hithink-finance auth login`. For non-interactive use, pipe it to `hithink-finance auth login --api-key-stdin`, or set HITHINK_FINANCE_API_KEY for the current process.';

dist/infrastructure/skills/installer.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @hithink-tech/hithink-finance-cli@0.1.1 matchedIdentity = npm:[redacted]:0.1.1 similarity = 0.971 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/infrastructure/skills/installer.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code