@keruyun/cli@1.5.1: Suspicious npm security report (Warn)

Loading npm security reports…

@keruyun/cli@1.5.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged

package.jsonView file

Lines 7-47json

7 "author": "玄宫",

8 "repository": {

9 "type": "git",

10 "url": "http://gitlab.alibaba-inc.com/alsc-kry-open/krycli.git"

11 },

12 "bin": {

13 "kry-cli": "./bin/index.js"

14 },

15 "files": [

16 "bin"

17 ],

18 "exports": {

19 "/sdk": {

20 "types": "./bin/sdk.mjs",

21 "import": "./bin/sdk.mjs"

22 }

23 },

24 "scripts": {

25 "precommit": "lint-staged",

26 "prepublishOnly": "tnpm run build",

27 "postinstall": "node bin/where_is_kry_cli.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

28 "build": "tsc --noEmit && tnpm run prod && tnpm run sdk && tnpm run py",

29 "local": "sh scripts/install-global.sh",

30 "dev": "KRY_FORCE_ENV=pre && tsc --watch",

31 "release": "yarn build && tnpm publish",

32 "release:npm": "node scripts/publish-release.mjs",

33 "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s",

34 "prepare": "husky install",

35 "lint:fix-script": "eslint --fix . --ext js,jsx,ts,tsx",

36 "lint:fix-style": "stylelint \"**/*.less\" --fix",

37 "lint:script": "eslint . --ext js,jsx,ts,tsx",

38 "lint:style": "stylelint \"**/*.less\"",

39 "commit": "git-cz",

40 "prod": "esbuild src/index.ts --bundle --minify --format=cjs --outfile=./bin/index.js --platform=node --legal-comments=none $ESBUILD_DEFINE && cp node_modules/sql.js/dist/sql-wasm.wasm ./bin/sql-wasm.wasm",

41 "sdk": "esbuild src/sdk.ts --bundle --minify --format=esm --outfile=./bin/sdk.mjs --platform=node --legal-comments=none $ESBUILD_DEFINE",

42 "py": "cp -f ./py/log.py ./bin/log.py",

43 "test": "vitest run",

44 "cp": "cp -f ./src/run/kry-cli /Users/lh/.real/.bin/node/bin/kry-cli",

45 "rm": "rm -f /Users/lh/.real/.bin/node/bin/kry-cli",

46 "doc": "node dist/schema/gen.js",

47 "pack": "node dist/pack/index.js",

bin/index.jsView file

•Browser cookie sent to a fixed external endpoint in bin/index.js: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await B_.checkPaths(t,e,"copy",r);if(await B_.checkParentPath... see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=U_.checkPathsSync(t,e,"copy",r);if(U_.checkParentPathsSync(t,... `))}}});var wB,_B=q(()=>{wB={major:4,minor:4,patch:3}});function HB(t){if(t==="")return!0;if(/\s/.test(t)||t.length%4!==0)return!1;try{return atob(t),!0}catch{return!1}}function th... Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of t.seen.entries()){let u=s[1];if(e===s[0]){a(s);continue}if(t.external){let p=t.exter..

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/index.jsView on unpkg

318`}),r.str+=` L319: \u6267\u884C ${yr.viewShopParams()} \u53EF\u67E5\u770B\u54C1\u724C\u4E0B\u95E8\u5E97\u5217\u8868`,e.warn("--brandId \u54C1\u724CID\u9519\u8BEF",{str:r.str}),r}if(t.shopIds){let a=t... L320: `))}),qwe(e)]);for(let a of i)if(a.status==="rejected")throw a.reason}function Vwe(t,e){return parseInt(t.replace(".",""),16)-parseInt(e.replace(".",""),16)}var wy,g0,ai,hSt,Gwe=q(...

High

Child Process

Package source references child process execution.

bin/index.jsView on unpkg · L318

bin/sql-wasm.wasmView file

•path = bin/sql-wasm.wasm kind = wasm_module sizeBytes = 659730 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/sql-wasm.wasmView on unpkg

bin/log.pyView file

•path = bin/log.py kind = build_helper sizeBytes = 10484 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/log.pyView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/where_is_kry_cli.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/index.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/index.jsView on unpkg

High

Child Process

Package source references child process execution.

bin/index.jsView on unpkg · L318

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/index.jsView on unpkg · L318

308`,e.brands.forEach(a=>{let s=(a.shopList||[]).length;n+=`- '${a.name}' \u4E0B\u6709 ${s} \u5BB6\u95E8\u5E97\uFF0C\u6267\u884C ${yr.viewShopParams({brandId:String(a.id)})} \u53EF\u6... L309: `})),console.log(n)}function jve(t){let e=Ve.child({tag:"printShop"}),r=El();if(!r.success){let u=`\u83B7\u53D6\u95E8\u5E97\u5217\u8868\u5931\u8D25\uFF0C\u8BF7\u5148\u6267\u884C ${... L310: | --- | --- |`,p=u;if(t?.keyword){let y=t.keyword.split("|").map(v=>v.toLowerCase().trim());p=u.filter(v=>y.some(x=>v.name.toLowerCase().includes(x)||String(v.id).includes(x)))}let... ... L318: `}),r.str+=` L319: \u6267\u884C ${yr.viewShopParams()} \u53EF\u67E5\u770B\u54C1\u724C\u4E0B\u95E8\u5E97\u5217\u8868`,e.warn("--brandId \u54C1\u724CID\u9519\u8BEF",{str:r.str}),r}if(t.shopIds){let a=t... L320: `))}),qwe(e

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/index.jsView on unpkg · L308

1#!/usr/bin/env node L2: "use strict";var kut=Object.create;var o7=Object.defineProperty;var Cut=Object.getOwnPropertyDescriptor;var Tut=Object.getOwnPropertyNames;var jut=Object.getPrototypeOf,Iut=Object.... L3: GFS4: `),console.error(t)});Ta[oo]||(qde=global[oo]||[],Hde(Ta,qde),Ta.close=(function(t){function e(r,n){return t.call(Ta,r,function(i){i||zde(),typeof n=="function"&&n.apply(this... L4: L5: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await B_.checkPaths(t,e,"copy",r);if(await B_.checkParentPath... L6: L7: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=U_.checkPathsSync(t,e,"copy",r);if(U_.checkParentPathsSync(t,... L8: `,finalEOL

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/index.jsView on unpkg · L1

2"use strict";var kut=Object.create;var o7=Object.defineProperty;var Cut=Object.getOwnPropertyDescriptor;var Tut=Object.getOwnPropertyNames;var jut=Object.getPrototypeOf,Iut=Object.... L3: GFS4: `),console.error(t)});Ta[oo]||(qde=global[oo]||[],Hde(Ta,qde),Ta.close=(function(t){function e(r,n){return t.call(Ta,r,function(i){i||zde(),typeof n=="function"&&n.apply(this... L4:

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

bin/index.jsView on unpkg · L2

308Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/index.js L308: `,e.brands.forEach(a=>{let s=(a.shopList||[]).length;n+=`- '${a.name}' \u4E0B\u6709 ${s} \u5BB6\u95E8\u5E97\uFF0C\u6267\u884C ${yr.viewShopParams({brandId:String(a.id)})} \u53EF\u6... L309: `})),console.log(n)}function jve(t){let e=Ve.child({tag:"printShop"}),r=El();if(!r.success){let u=`\u83B7\u53D6\u95E8\u5E97\u5217\u8868\u5931\u8D25\uFF0C\u8BF7\u5148\u6267\u884C ${... L310: | --- | --- |`,p=u;if(t?.keyword){let y=t.keyword.split("|").map(v=>v.toLowerCase().trim());p=u.filter(v=>y.some(x=>v.name.toLowerCase().includes(x)||String(v.id).includes(x)))}let... ... L318: `}),r.str+=` L319: \u6267\u884C ${yr.viewShopParams()} \u53EF\u67E5\u770B\u54C1\u724C\u4E0B\u95E8\u5E97\u5217\u8868`,e.warn("--brandId \u5

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/index.jsView on unpkg · L308

1Trigger-reachable persistence chain: manifest.bin -> bin/index.js L1: #!/usr/bin/env node L2: "use strict";var kut=Object.create;var o7=Object.defineProperty;var Cut=Object.getOwnPropertyDescriptor;var Tut=Object.getOwnPropertyNames;var jut=Object.getPrototypeOf,Iut=Object.... L3: GFS4: `),console.error(t)});Ta[oo]||(qde=global[oo]||[],Hde(Ta,qde),Ta.close=(function(t){function e(r,n){return t.call(Ta,r,function(i){i||zde(),typeof n=="function"&&n.apply(this... L4: L5: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await B_.checkPaths(t,e,"copy",r);if(await B_.checkParentPath... L6: L7: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=U_.checkPaths

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/index.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/index.jsView on unpkg

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/index.jsView on unpkg · L1

•path = bin/index.js kind = oversized_source_file sizeBytes = 5197079 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

bin/index.jsView on unpkg

•path = bin/index.js kind = oversized_cli_entrypoint sizeBytes = 5197079 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/index.jsView on unpkg

bin/sql-wasm.wasmView file

•path = bin/sql-wasm.wasm kind = wasm_module sizeBytes = 659730 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/sql-wasm.wasmView on unpkg

bin/log.pyView file

•path = bin/log.py kind = build_helper sizeBytes = 10484 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/log.pyView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 7-47json

7 "author": "玄宫",

8 "repository": {

9 "type": "git",

10 "url": "http://gitlab.alibaba-inc.com/alsc-kry-open/krycli.git"

11 },

12 "bin": {

13 "kry-cli": "./bin/index.js"

14 },

15 "files": [

16 "bin"

17 ],

18 "exports": {

19 "/sdk": {

20 "types": "./bin/sdk.mjs",

21 "import": "./bin/sdk.mjs"

22 }

23 },

24 "scripts": {

25 "precommit": "lint-staged",

26 "prepublishOnly": "tnpm run build",

27 "postinstall": "node bin/where_is_kry_cli.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

28 "build": "tsc --noEmit && tnpm run prod && tnpm run sdk && tnpm run py",

29 "local": "sh scripts/install-global.sh",

30 "dev": "KRY_FORCE_ENV=pre && tsc --watch",

31 "release": "yarn build && tnpm publish",

32 "release:npm": "node scripts/publish-release.mjs",

33 "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s",

34 "prepare": "husky install",

35 "lint:fix-script": "eslint --fix . --ext js,jsx,ts,tsx",

36 "lint:fix-style": "stylelint \"**/*.less\" --fix",

37 "lint:script": "eslint . --ext js,jsx,ts,tsx",

38 "lint:style": "stylelint \"**/*.less\"",

39 "commit": "git-cz",

41 "sdk": "esbuild src/sdk.ts --bundle --minify --format=esm --outfile=./bin/sdk.mjs --platform=node --legal-comments=none $ESBUILD_DEFINE",

42 "py": "cp -f ./py/log.py ./bin/log.py",

43 "test": "vitest run",

44 "cp": "cp -f ./src/run/kry-cli /Users/lh/.real/.bin/node/bin/kry-cli",

45 "rm": "rm -f /Users/lh/.real/.bin/node/bin/kry-cli",

46 "doc": "node dist/schema/gen.js",

47 "pack": "node dist/pack/index.js",

bin/index.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/index.jsView on unpkg

High

Child Process

Package source references child process execution.

bin/index.jsView on unpkg · L318

bin/sql-wasm.wasmView file

•path = bin/sql-wasm.wasm kind = wasm_module sizeBytes = 659730 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/sql-wasm.wasmView on unpkg

bin/log.pyView file

•path = bin/log.py kind = build_helper sizeBytes = 10484 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/log.pyView on unpkg

@keruyun/cli@1.5.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code