registry  /  @huicai/cli  /  2026.711.24616

@huicai/cli@2026.711.24616

在终端运行的智能体 CLI：以 HuiCai_AI 平台的 OpenAI 兼容 /v1 为模型后端，在用户本机执行文件/命令工具。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedUrlStrings
Manifest
NoLicense
scanned 48 file(s), 211 KB of source, external domains: a.com, huicai-ai.sjht.com

Source & flagged code

5 flagged · loading source
src/device.jsView file
1import{spawn as e}from"node:child_process";import{c as t}from"./colors.js";async function o(e,t,o){const r=await fetch(`${e}${t}`,{method:"POST",headers:{"Content-Type":"applicatio...
High
Child Process

Package source references child process execution.

src/device.jsView on unpkg · L1
1import{spawn as e}from"node:child_process";import{c as t}from"./colors.js";async function o(e,t,o){const r=await fetch(`${e}${t}`,{method:"POST",headers:{"Content-Type":"applicatio...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/device.jsView on unpkg · L1
1import{spawn as e}from"node:child_process";import{c as t}from"./colors.js";async function o(e,t,o){const r=await fetch(`${e}${t}`,{method:"POST",headers:{"Content-Type":"applicatio...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/device.jsView on unpkg · L1
src/memory.jsView file
1import e from"node:fs";import r from"node:path";import t from"node:crypto";import{CONFIG_DIR as n}from"./config.js";import{tokenize as o}from"./codeindex.js";export const MEMORY_DI...
Low
Weak Crypto

Package source references weak cryptographic algorithms.

src/memory.jsView on unpkg · L1
src/schedule.jsView file
1import r from"node:fs";import n from"node:path";import t from"node:os";export const SCHEDULE_FILE=n.join(t.homedir(),".huicai","schedule.json");function o(){try{const n=JSON.parse(...
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/schedule.jsView on unpkg · L1

Findings

3 High4 Medium7 Low
HighChild Processsrc/device.js
HighSame File Env Network Executionsrc/device.js
HighCommand Output Exfiltrationsrc/device.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/schedule.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptosrc/memory.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License