registry / @iga-pages/cli / 1.1.4
@iga-pages/cli@1.1.4
A CLI tool for IGA Pages
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's eval finding is bundled dependency-style optional-require logic, while network and credential operations are aligned with an explicit cloud deployment CLI. Source inspection found no lifecycle execution or concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User invokes the iga CLI, especially login or deployment commands.
Impact
No unconsented install-time execution, credential harvesting, or remote payload execution confirmed.
Mechanism
User-invoked cloud deployment, authentication, and telemetry
AI rationale
The scanner's eval finding is bundled dependency-style optional-require logic, while network and credential operations are aligned with an explicit cloud deployment CLI. Source inspection found no lifecycle execution or concrete malicious chain.
Evidence
package.jsonbin/iga.jsdist/index.jsdist/0~569.jsdist/request-handler.js~/.iga/auth.json
Network endpoints2
mcs.zijieapi.com/listsgali-mcs.byteoversea.com/list
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- CLI telemetry posts command events to ByteDance telemetry endpoints.
- Explicit login persists supplied credentials in ~/.iga/auth.json.
Evidence against
- package.json has no npm lifecycle hooks.
- The bin only loads the bundled CLI; actions are command-driven.
- Telemetry declares accessKey, secretKey, and value as sensitive parameters.
- No remote-code execution, stealth persistence, or unrelated credential harvesting was confirmed.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Oversized source lightweight scan
dist/index.js4.14 MB file, sampled 256 KB
Source & flagged code
13 flaggeddist/index.jsView file
34},
L35: "../../node_modules/.pnpm/@protobufjs+base64@1.1.2/node_modules/@protobufjs/base64/index.js" (__unused_rspack_module, exports1) {
L36: "use strict";
...
L221: if (!options.xhr && fs && fs.readFile) return fs.readFile(filename, function(err, contents) {
L222: return err && "u" > typeof XMLHttpRequest ? fetch1.xhr(filename, options, callback) : err ? callback(err) : callback(null, options.binary ? contents : contents.toString("utf8"));
L223: });
...
L245: xhr.open("GET", filename);
L246: xhr.send();
L247: };
...
L428: try {
L429: var mod = eval("quire".replace(/^/, "re"))(moduleName);
L430: if (mod && (mod.length || Object.keys(mod).length)) return mod;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L3434},
L35: "../../node_modules/.pnpm/@protobufjs+base64@1.1.2/node_modules/@protobufjs/base64/index.js" (__unused_rspack_module, exports1) {
L36: "use strict";
...
L221: if (!options.xhr && fs && fs.readFile) return fs.readFile(filename, function(err, contents) {
L222: return err && "u" > typeof XMLHttpRequest ? fetch1.xhr(filename, options, callback) : err ? callback(err) : callback(null, options.binary ? contents : contents.toString("utf8"));
L223: });
...
L245: xhr.open("GET", filename);
L246: xhr.send();
L247: };
...
L428: try {
L429: var mod = eval("quire".replace(/^/, "re"))(moduleName);
L430: if (mod && (mod.length || Object.keys(mod).length)) return mod;
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/index.jsFindings
3 Critical8 High4 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighEvaldist/index.js
HighCredential Redirect Persistencedist/index.js
HighEntrypoint Foreign Package Code Overwritedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighCross File Remote Execution Contextdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumNetwork
Affected versions and remediation
This report applies to @iga-pages/cli@1.1.4.
See all versions of @iga-pages/cli for other recorded verdicts.
- Review the evidence and your use of @iga-pages/cli@1.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.