registry / @iga-pages/cli / 1.1.13
@iga-pages/cli@1.1.13
⚠ Under reviewA CLI tool for IGA Pages
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest declares @byted/uni-sso@0.1.32 as an optional dependency, but its source was unavailable in the prepared snapshot, so its install behavior could not be assessed. The inspected CLI telemetry and available esbuild installer did not establish an attack; the unresolved dependency prevents a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing this package may attempt to install its declared optional dependency.
Impact
No harmful effect was established, but the missing dependency source prevents a clean determination.
Mechanism
The optional dependency's behavior could not be traced; the reviewed CLI entrypoint loads the bundle, and the available esbuild hook performs platform setup.
AI rationale
The manifest declares @byted/uni-sso@0.1.32 as an optional dependency, but its source was unavailable in the prepared snapshot, so its install behavior could not be assessed. The inspected CLI telemetry and available esbuild installer did not establish an attack; the unresolved dependency prevents a clean verdict.
Evidence
package.jsonbin/iga.jsdist/index.js.lpm-dependency-evidence-e64843b9-b92c-42de-9c5c-ea13e02d7bf8/0/npm-linux/package.json.lpm-dependency-evidence-e64843b9-b92c-42de-9c5c-ea13e02d7bf8/0/npm-linux/install.js.lpm-dependency-evidence-e64843b9-b92c-42de-9c5c-ea13e02d7bf8/0/npm-linux/lib/main.js
Network endpoints3
mcs.zijieapi.com/listsgali-mcs.byteoversea.com/listregistry.npmjs.org
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @byted/uni-sso@0.1.32 as an optional dependency, but its source is absent from the prepared dependency snapshot, leaving its behavior unresolved.
- The CLI executable loads dist/index.js.
- The inspected telemetry code submits command metadata in a JSON POST; its configured endpoints are the listed ByteDance telemetry URLs.
- The available esbuild dependency declares a postinstall hook for platform setup, with an npm registry download fallback.
Evidence against
- The inspected esbuild runtime excerpt formats build errors; it does not establish harmful behavior.
- No attack was confirmed in the inspected package source.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
13 flaggeddist/functions-runtime.jsView file
11357exports1.execCommand = execCommand;
L11358: const child_process_1 = __webpack_require__("child_process");
L11359: function spawnCommand(command, opts = {}) {
High
Child Process
Package source references child process execution.
dist/functions-runtime.jsView on unpkg · L11357bin/iga.jsView file
2L3: require('../dist/index.js');
L4:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/iga.jsView on unpkg · L2dist/index.jsView file
4/*! For license information please see index.js.LICENSE.txt */
L5: const __rslib_import_meta_url__="u"<typeof document?new(require("url".replace("",""))).URL("file:"+__filename).href:document.currentScript&&document.currentScript.src||new URL("mai...
L6: `),e.push(this.signedHeaders()),e.push(this.hexEncodedBodyHash());let r=e.join("\n");return l("--------CanonicalString:\n%s",r),r}canonicalHeaders(){let e=[];Object.keys(this.reque...
L7: `)),this}stop(){return this.isEnabled&&(clearInterval(this.id),this.id=void 0,this.frameIndex=0,this.clear(),this.hideCursor&&o.show(this.stream),this.discardStdin&&process.stdin.i...
...
L154: → using pnpm@${e.versionRange} by default
L155: To use ${n}, add "packageManager": "${"pnpm@10.x"===n?"pnpm@10.27.0":"pnpm@9.14.4"}" to package.json`}if(e.vers
Findings
4 Critical8 High4 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/functions-runtime.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
Affected versions and remediation
This report applies to @iga-pages/cli@1.1.13.
See all versions of @iga-pages/cli for other recorded verdicts.
- Review the evidence and your use of @iga-pages/cli@1.1.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.