registry / Data exfiltration / @keruyun/cli
@keruyun/cli
客如云 CLI 工具
This report shows the evidence for @keruyun/cli@1.5.2. 1 of 3 known versions is blocked or flagged. The newest version, 1.5.3, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource confirms default telemetry of rich runtime context and unprompted global updates on every CLI invocation. The harmless postinstall locator does not mitigate these runtime behaviors.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Any kry-cli command execution
Impact
CLI arguments and merchant/device metadata may be disclosed; registry-controlled releases execute through global npm installation.
Mechanism
Default telemetry exfiltration and automatic global package update
Attack narrative
A user runs any kry-cli command. Its pre-action hook captures command context, including argv, merchant identifiers, user-derived fields, host details, and agent-work-root data, then posts logs to a fixed remote receiver. The same pre-action phase checks a registry and, when a higher version is advertised, launches a global npm install without prompting. This creates default disclosure of potentially sensitive command input and a remote-controlled update execution path.
AI rationale
Source confirms default telemetry of rich runtime context and unprompted global updates on every CLI invocation. The harmless postinstall locator does not mitigate these runtime behaviors.
Evidence
bin/index.jsbin/log.pypackage.jsonbin/where_is_kry_cli.js
Network endpoints3
tnnm-alsc-saas-merchant-spider-fy21.cn-wulanchabu.log.aliyuncs.com/logstores/kry-cli/track?APIVersion=0.6.0registry.npmmirror.comregistry.anpm.alibaba-inc.com
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- Every CLI command sends telemetry including command arguments and host/user context to a fixed Aliyun endpoint.
- The runtime pre-action hook performs an automatic global npm upgrade when a newer registry version exists.
- Telemetry can include arbitrary CLI-supplied data, making credential or business-data disclosure possible.
Evidence against
- The postinstall script only locates and prints the installed binary path; it does not modify files.
- No install-time foreign AI-agent configuration mutation was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedProtestwareUrlStrings
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/where_is_kry_cli.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/index.jsView file
•Browser cookie sent to a fixed external endpoint in bin/index.js:
see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await cw.checkPaths(r,e,"copy",t);if(await cw.checkParentPath...
see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=lw.checkPathsSync(r,e,"copy",t);if(lw.checkParentPathsSync(r,...
`))}}});var oN,cN=M(()=>{oN={major:4,minor:4,patch:3}});function AN(r){if(r==="")return!0;if(/\s/.test(r)||r.length%4!==0)return!1;try{return atob(r),!0}catch{return!1}}function Lc...
Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of r.seen.entries()){let u=s[1];if(e===s[0]){a(s);continue}if(r.external){let p=r.exter..
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
bin/index.jsView on unpkgFindings
2 Critical10 High8 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationbin/index.js
CriticalPrevious Version Dangerous Deltabin/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/index.js
HighSame File Env Network Executionbin/index.js
HighCredential Redirect Persistencebin/index.js
HighEntrypoint Foreign Package Code Overwritebin/index.js
HighCommand Output Exfiltrationbin/index.js
HighSandbox Evasion Gated Capabilitybin/index.js
HighObfuscated Payload Loaderbin/index.js
HighTrigger Reachable Command Output Exfiltrationbin/index.js
High
Affected versions and remediation
This report applies to @keruyun/cli@1.5.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing @keruyun/cli@1.5.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.