@keruyun/cli@1.5.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@keruyun/cli@1.5.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/where_is_kry_cli.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/index.jsView file

•Browser cookie sent to a fixed external endpoint in bin/index.js: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await cw.checkPaths(r,e,"copy",t);if(await cw.checkParentPath... see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=lw.checkPathsSync(r,e,"copy",t);if(lw.checkParentPathsSync(r,... `))}}});var oN,cN=M(()=>{oN={major:4,minor:4,patch:3}});function AN(r){if(r==="")return!0;if(/\s/.test(r)||r.length%4!==0)return!1;try{return atob(r),!0}catch{return!1}}function Lc... Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of r.seen.entries()){let u=s[1];if(e===s[0]){a(s);continue}if(r.external){let p=r.exter..

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @keruyun/cli@1.5.1 matchedIdentity = npm:QGtlcnV5dW4vY2xp:1.5.1 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/index.jsView on unpkg

321Expected: ${n.toLowerCase()} L322: Actual: ${i}`)}}}});function _k(r){switch(r){case It.LINUX_ARM:case It.LINUX:return"linux64";case It.MAC_ARM:return"mac-arm64";case It.MAC:return"mac-x64";case It.WIN32:return"wi... L323: `))}),Mge(e)]);for(let a of i)if(a.status==="rejected")throw a.reason}function Uge(r,e){return parseInt(r.replace(".",""),16)-parseInt(e.replace(".",""),16)}var bb,Lf,ti,R1t,zge=M(...

High

Child Process

Package source references child process execution.

bin/index.jsView on unpkg · L321

318`}),t.str+=` L319: \u6267\u884C ${yr.viewShopParams()} \u53EF\u67E5\u770B\u54C1\u724C\u4E0B\u95E8\u5E97\u5217\u8868`,e.warn("--brandId \u54C1\u724CID\u9519\u8BEF",{str:t.str}),t}if(r.shopIds){let a=r... L320: URL: ${e} L321: Expected: ${n.toLowerCase()} L322: Actual: ${i}`)}}}});function _k(r){switch(r){case It.LINUX_ARM:case It.LINUX:return"linux64";case It.MAC_ARM:return"mac-arm64";case It.MAC:return"mac-x64";case It.WIN32:return"wi... L323: `))}),Mge(e)]);for(let a of i)if(a.status==="rejected")throw a.reason}function Uge(r,e){return parseInt(r.replace(".",""),16)-parseInt(e.replace(".",""),16)}var bb,Lf,ti,R1t,zge=M(...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/index.jsView on unpkg · L318

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. bin/index.js: GFS4: `),console.error(r)});ma[qs]||(Tse=global[qs]||[],jse(ma,Tse),ma.close=(function(r){function e(t,n){return r.call(ma,t,function(i){i||Dse(),typeof n=="function"&&n.apply(this... see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=lw.checkPathsSync(r,e,"copy",t);if(lw.checkParentPathsSync(r,... `,finalEOL:t=!0,replacer:n=null,spaces:i}={}){let a=t?e:"",s=JSON.stringify(r,n,i);if(s===void 0)throw new TypeError(`Converting ${typeof r} value to JSON is not supported`);return... </html>`}function p$(){return X2.randomBytes(32).toString("base64url")}functi

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

bin/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/index.js: GFS4: `),console.error(r)});ma[qs]||(Tse=global[qs]||[],jse(ma,Tse),ma.close=(function(r){function e(t,n){return r.call(ma,t,function(i){i||Dse(),typeof n=="function"&&n.apply(this... see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await cw.checkPaths(r,e,"copy",t);if(await cw.checkParentPath... see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=lw.checkPathsSync(r,e,"copy",t);if(lw.checkParentPathsSync(r,... `,finalEOL:t=!0,replacer:n=null,spaces:i}={}){let a=t?e:"",s=JSON.stringify(r,n,i);if(s===void 0)t

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/index.jsView on unpkg

308`,e.brands.forEach(a=>{let s=(a.shopList||[]).length;n+=`- '${a.name}' \u4E0B\u6709 ${s} \u5BB6\u95E8\u5E97\uFF0C\u6267\u884C ${yr.viewShopParams({brandId:String(a.id)})} \u53EF\u6... L309: `})),console.log(n)}function pge(r){let e=We.child({tag:"printShop"}),t=Qc();if(!t.success){let u=`\u83B7\u53D6\u95E8\u5E97\u5217\u8868\u5931\u8D25\uFF0C\u8BF7\u5148\u6267\u884C ${... L310: | --- | --- |`,p=u;if(r?.keyword){let y=r.keyword.split("|").map(v=>v.toLowerCase().trim());p=u.filter(v=>y.some(x=>v.name.toLowerCase().includes(x)||String(v.id).includes(x)))}let... ... L318: `}),t.str+=` L319: \u6267\u884C ${yr.viewShopParams()} \u53EF\u67E5\u770B\u54C1\u724C\u4E0B\u95E8\u5E97\u5217\u8868`,e.warn("--brandId \u54C1\u724CID\u9519\u8BEF",{str:t.str}),t}if(r.shopIds){let a=r... L320: URL: $

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/index.jsView on unpkg · L308

1#!/usr/bin/env node L2: "use strict";var GQe=Object.create;var $E=Object.defineProperty;var KQe=Object.getOwnPropertyDescriptor;var YQe=Object.getOwnPropertyNames;var XQe=Object.getPrototypeOf,ZQe=Object.... L3: GFS4: `),console.error(r)});ma[qs]||(Tse=global[qs]||[],jse(ma,Tse),ma.close=(function(r){function e(t,n){return r.call(ma,t,function(i){i||Dse(),typeof n=="function"&&n.apply(this... L4: L5: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await cw.checkPaths(r,e,"copy",t);if(await cw.checkParentPath... L6: L7: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=lw.checkPathsSync(r,e,"copy",t);if(lw.checkParentPathsSync(r,... L8: `,finalEOL

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/index.jsView on unpkg · L1

2"use strict";var GQe=Object.create;var $E=Object.defineProperty;var KQe=Object.getOwnPropertyDescriptor;var YQe=Object.getOwnPropertyNames;var XQe=Object.getPrototypeOf,ZQe=Object.... L3: GFS4: `),console.error(r)});ma[qs]||(Tse=global[qs]||[],jse(ma,Tse),ma.close=(function(r){function e(t,n){return r.call(ma,t,function(i){i||Dse(),typeof n=="function"&&n.apply(this... L4:

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

bin/index.jsView on unpkg · L2

308Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/index.js L308: `,e.brands.forEach(a=>{let s=(a.shopList||[]).length;n+=`- '${a.name}' \u4E0B\u6709 ${s} \u5BB6\u95E8\u5E97\uFF0C\u6267\u884C ${yr.viewShopParams({brandId:String(a.id)})} \u53EF\u6... L309: `})),console.log(n)}function pge(r){let e=We.child({tag:"printShop"}),t=Qc();if(!t.success){let u=`\u83B7\u53D6\u95E8\u5E97\u5217\u8868\u5931\u8D25\uFF0C\u8BF7\u5148\u6267\u884C ${... L310: | --- | --- |`,p=u;if(r?.keyword){let y=r.keyword.split("|").map(v=>v.toLowerCase().trim());p=u.filter(v=>y.some(x=>v.name.toLowerCase().includes(x)||String(v.id).includes(x)))}let... ... L318: `}),t.str+=` L319: \u6267\u884C ${yr.viewShopParams()} \u53EF\u67E5\u770B\u54C1\u724C\u4E0B\u95E8\u5E97\u5217\u8868`,e.warn("--brandId \u5

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/index.jsView on unpkg · L308

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/index.jsView on unpkg

•path = bin/index.js kind = oversized_source_file sizeBytes = 5058164 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

bin/index.jsView on unpkg

•path = bin/index.js kind = oversized_cli_entrypoint sizeBytes = 5058164 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/index.jsView on unpkg

bin/sql-wasm.wasmView file

•path = bin/sql-wasm.wasm kind = wasm_module sizeBytes = 659730 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/sql-wasm.wasmView on unpkg

bin/log.pyView file

•path = bin/log.py kind = build_helper sizeBytes = 10484 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/log.pyView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 7-47json

7 "author": "玄宫",

8 "repository": {

9 "type": "git",

10 "url": "http://gitlab.alibaba-inc.com/alsc-kry-open/krycli.git"

11 },

12 "bin": {

13 "kry-cli": "./bin/index.js"

14 },

15 "files": [

16 "bin"

17 ],

18 "exports": {

19 "/sdk": {

20 "types": "./bin/sdk.mjs",

21 "import": "./bin/sdk.mjs"

22 }

23 },

24 "scripts": {

25 "precommit": "lint-staged",

26 "prepublishOnly": "tnpm run build",

27 "postinstall": "node bin/where_is_kry_cli.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

28 "build": "tsc --noEmit && tnpm run prod && tnpm run sdk && tnpm run py",

29 "local": "sh scripts/install-global.sh",

30 "dev": "KRY_FORCE_ENV=pre && tsc --watch",

31 "release": "yarn build && tnpm publish",

32 "release:npm": "node scripts/publish-release.mjs",

33 "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s",

34 "prepare": "husky install",

35 "lint:fix-script": "eslint --fix . --ext js,jsx,ts,tsx",

36 "lint:fix-style": "stylelint \"**/*.less\" --fix",

37 "lint:script": "eslint . --ext js,jsx,ts,tsx",

38 "lint:style": "stylelint \"**/*.less\"",

39 "commit": "git-cz",

40 "prod": "esbuild src/index.ts --bundle --minify --format=cjs --outfile=./bin/index.js --platform=node --legal-comments=none $ESBUILD_DEFINE && cp node_modules/sql.js/dist/sql-wasm.wasm ./bin/sql-wasm.wasm",

41 "sdk": "esbuild src/sdk.ts --bundle --minify --format=esm --outfile=./bin/sdk.mjs --platform=node --legal-comments=none $ESBUILD_DEFINE",

42 "py": "cp -f ./py/log.py ./bin/log.py",

43 "test": "vitest run",

44 "cp": "cp -f ./src/run/kry-cli /Users/lh/.real/.bin/node/bin/kry-cli",

45 "rm": "rm -f /Users/lh/.real/.bin/node/bin/kry-cli",

46 "doc": "node dist/schema/gen.js",

47 "pack": "node dist/pack/index.js",

bin/index.jsView file

•Browser cookie sent to a fixed external endpoint in bin/index.js: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await cw.checkPaths(r,e,"copy",t);if(await cw.checkParentPath... see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=lw.checkPathsSync(r,e,"copy",t);if(lw.checkParentPathsSync(r,... `))}}});var oN,cN=M(()=>{oN={major:4,minor:4,patch:3}});function AN(r){if(r==="")return!0;if(/\s/.test(r)||r.length%4!==0)return!1;try{return atob(r),!0}catch{return!1}}function Lc... Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of r.seen.entries()){let u=s[1];if(e===s[0]){a(s);continue}if(r.external){let p=r.exter..

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @keruyun/cli@1.5.1 matchedIdentity = npm:QGtlcnV5dW4vY2xp:1.5.1 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/index.jsView on unpkg

321Expected: ${n.toLowerCase()} L322: Actual: ${i}`)}}}});function _k(r){switch(r){case It.LINUX_ARM:case It.LINUX:return"linux64";case It.MAC_ARM:return"mac-arm64";case It.MAC:return"mac-x64";case It.WIN32:return"wi... L323: `))}),Mge(e)]);for(let a of i)if(a.status==="rejected")throw a.reason}function Uge(r,e){return parseInt(r.replace(".",""),16)-parseInt(e.replace(".",""),16)}var bb,Lf,ti,R1t,zge=M(...

bin/sql-wasm.wasmView file

•path = bin/sql-wasm.wasm kind = wasm_module sizeBytes = 659730 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/sql-wasm.wasmView on unpkg

bin/log.pyView file

•path = bin/log.py kind = build_helper sizeBytes = 10484 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/log.pyView on unpkg