@keruyun/cli@1.5.3

⚠ Under review

客如云 CLI 工具

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 23 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 269 KB of source, external domains: 127.0.0.1, github.com, gitlab.alibaba-inc.com, gldopen.keruyun.com, gldopenapi.keruyun.com, life.douyin.com, open.keruyun.com, openapi.keruyun.com, preopen.tongyun0815.com, preopenapi.tongyun0815.com, tnnm-alsc-saas-merchant-spider-fy21.cn-wulanchabu.log.aliyuncs.com, www.life-data.cn, zj.tousu.sina.com.cn

Oversized source lightweight scan

bin/index.js4.82 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStrings127.0.0.1github.comgitlab.alibaba-inc.comlife.douyin.comwww.life-data.cn

Source & flagged code

15 flagged

package.jsonView file

Lines 7-47json

7 "author": "玄宫",

8 "repository": {

9 "type": "git",

10 "url": "http://gitlab.alibaba-inc.com/alsc-kry-open/krycli.git"

11 },

12 "bin": {

13 "kry-cli": "./bin/index.js"

14 },

15 "files": [

16 "bin"

17 ],

18 "exports": {

19 "/sdk": {

20 "types": "./bin/sdk.mjs",

21 "import": "./bin/sdk.mjs"

22 }

23 },

24 "scripts": {

25 "precommit": "lint-staged",

26 "prepublishOnly": "tnpm run build",

27 "postinstall": "node bin/where_is_kry_cli.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

28 "build": "tsc --noEmit && tnpm run prod && tnpm run sdk && tnpm run py",

29 "local": "sh scripts/install-global.sh",

30 "dev": "KRY_FORCE_ENV=pre && tsc --watch",

31 "release": "yarn build && tnpm publish",

32 "release:npm": "node scripts/publish-release.mjs",

33 "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s",

34 "prepare": "husky install",

35 "lint:fix-script": "eslint --fix . --ext js,jsx,ts,tsx",

36 "lint:fix-style": "stylelint \"**/*.less\" --fix",

37 "lint:script": "eslint . --ext js,jsx,ts,tsx",

38 "lint:style": "stylelint \"**/*.less\"",

39 "commit": "git-cz",

40 "prod": "esbuild src/index.ts --bundle --minify --format=cjs --outfile=./bin/index.js --platform=node --legal-comments=none $ESBUILD_DEFINE && cp node_modules/sql.js/dist/sql-wasm.wasm ./bin/sql-wasm.wasm",

41 "sdk": "esbuild src/sdk.ts --bundle --minify --format=esm --outfile=./bin/sdk.mjs --platform=node --legal-comments=none $ESBUILD_DEFINE",

42 "py": "cp -f ./py/log.py ./bin/log.py",

43 "test": "vitest run",

44 "cp": "cp -f ./src/run/kry-cli /Users/lh/.real/.bin/node/bin/kry-cli",

45 "rm": "rm -f /Users/lh/.real/.bin/node/bin/kry-cli",

46 "doc": "node dist/schema/gen.js",

47 "pack": "node dist/pack/index.js",

bin/index.jsView file

•Browser cookie sent to a fixed external endpoint in bin/index.js: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await cw.checkPaths(r,e,"copy",t);if(await cw.checkParentPath... see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=lw.checkPathsSync(r,e,"copy",t);if(lw.checkParentPathsSync(r,... `))}}});var oN,cN=M(()=>{oN={major:4,minor:4,patch:3}});function AN(r){if(r==="")return!0;if(/\s/.test(r)||r.length%4!==0)return!1;try{return atob(r),!0}catch{return!1}}function Bc... Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of r.seen.entries()){let u=s[1];if(e===s[0]){a(s);continue}if(r.external){let p=r.exter..

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/index.jsView on unpkg

1Trigger-reachable chain: manifest.bin -> bin/index.js L1: #!/usr/bin/env node L2: "use strict";var YQe=Object.create;var UE=Object.defineProperty;var XQe=Object.getOwnPropertyDescriptor;var ZQe=Object.getOwnPropertyNames;var JQe=Object.getPrototypeOf,QQe=Object.... L3: GFS4: `),console.error(r)});ma[qs]||(Dse=global[qs]||[],Ase(ma,Dse),ma.close=(function(r){function e(t,n){return r.call(ma,t,function(i){i||jse(),typeof n=="function"&&n.apply(this... L4: L5: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:n,destStat:i}=await cw.checkPaths(r,e,"copy",t);if(await cw.checkParentPath... L6: L7: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:n,destStat:i}=lw.checkPathsSync(r,e,"co

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/index.jsView on unpkg · L1

bin/sql-wasm.wasmView file

•path = bin/sql-wasm.wasm kind = wasm_module sizeBytes = 659730 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/sql-wasm.wasmView on unpkg

bin/log.pyView file

•path = bin/log.py kind = build_helper sizeBytes = 10484 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/log.pyView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/where_is_kry_cli.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/index.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/index.jsView on unpkg

Findings

2 Critical9 High7 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationbin/index.js

CriticalTrigger Reachable Dangerous Capabilitybin/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/index.js

HighSame File Env Network Executionbin/index.js

HighCredential Redirect Persistencebin/index.js

HighCommand Output Exfiltrationbin/index.js

HighSandbox Evasion Gated Capabilitybin/index.js

HighObfuscated Payload Loaderbin/index.js

HighTrigger Reachable Command Output Exfiltrationbin/index.js

HighSemantic Analysis Limitedbin/index.js

MediumNetwork

Affected versions and remediation

This report applies to @keruyun/cli@1.5.3.

See all versions of @keruyun/cli for other recorded verdicts.

Review the evidence and your use of @keruyun/cli@1.5.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 18:43:10.137Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @keruyun

Related packages

More from @keruyun

Source & flagged code