registry / @kmlckj/licos-ai-cli / 1.1.9

@kmlckj/licos-ai-cli@1.1.9

LICOS AI coding workspace CLI - project template engine and dev tools

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 573 file(s), 1.99 MB of source, external domains: caniuse.com, licos.ai, nextjs.org, registry.npmjs.org, registry.npmmirror.com, yaml.org

Source & flagged code

7 flagged

lib/__templates__/expo/template.config.jsView file

Lines 1-22javascript

3import { spawn } from 'child_process';

4import { resolve, join, basename, dirname } from 'path';

High

Child Process

Package source references child process execution.

lib/__templates__/expo/template.config.jsView on unpkg · L2

5import { appendFileSync, openSync, closeSync, mkdirSync } from 'fs';

6import { fileURLToPath } from 'url';

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = dirname(__filename);

16export const paramsSchema = {

17 type: 'object',

18 properties: {

19 appName: {

20 type: 'string',

21 minLength: 1,

22 pattern: '^[a-z0-9-]+$',

lib/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2'use strict';

4var commander = require('commander');

5var path = require('path');

6var fs = require('fs');

7var debug =

lib/__templates__/expo/server/build.jsView file

Lines 1-22javascript

1import * as esbuild from 'esbuild';

2import { createRequire } from 'module';

4const require = createRequire(import.meta.url);

5const pkg

lib/__templates__/expo/client/scripts/install-missing-deps.jsView file

Lines 62-102javascript

63 if (missingPackages.length === 0) {

64 console.log('没有发现缺失的依赖');

65 process.exit(0);

66 }

68 console.log('发现以下缺失的依赖：');

lib/__templates__/agent/scripts/setup.shView file

•path = lib/__templates__/agent/scripts/setup.sh kind = build_helper sizeBytes = 3816 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/__templates__/agent/scripts/setup.shView on unpkg

lib/__templates__/expo/.licosproj/scripts/server_dev_run.shView file

•path = lib/__templates__/expo/.licosproj/scripts/server_dev_run.sh kind = payload_in_excluded_dir sizeBytes = 1743 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

lib/__templates__/expo/.licosproj/scripts/server_dev_run.shView on unpkg

Source & flagged code

7 flagged · loading source

lib/__templates__/expo/template.config.jsView file

2L3: import { spawn } from 'child_process'; L4: import { resolve, join, basename, dirname } from 'path';

High

Child Process

Package source references child process execution.

lib/__templates__/expo/template.config.jsView on unpkg · L2

lib/cli.jsView file

11var node_fs = require('node:fs'); L12: var shelljs = require('shelljs'); L13: var perf_hooks = require('perf_hooks');

High

Shell

Package source references shell execution.

lib/cli.jsView on unpkg · L11

2676L2677: const result = shelljs.exec( L2678: 'pnpm install --registry=https://registry.npmmirror.com --prefer-frozen-lockfile --prefer-offline --reporter=append-only', L2679: { ... L2684: L2685: // 输出 stdout L2686: if (result.stdout) { L2687: process.stdout.write(result.stdout); L2688: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/cli.jsView on unpkg · L2676

lib/__templates__/expo/server/build.jsView file

3L4: const require = createRequire(import.meta.url); L5: const pkg = require('./package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/__templates__/expo/server/build.jsView on unpkg · L3

lib/__templates__/expo/client/scripts/install-missing-deps.jsView file

82try { L83: execSync(`pnpm exec expo install ${packagesToInstall}`, { L84: stdio: 'inherit', ... L93: } catch (installError) { L94: console.log('\nexpo install 失败，尝试使用 pnpm add --registry=https://registry.npmmirror.com...\n'); L95:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/__templates__/expo/client/scripts/install-missing-deps.jsView on unpkg · L82

lib/__templates__/agent/scripts/setup.shView file

•path = lib/__templates__/agent/scripts/setup.sh kind = build_helper sizeBytes = 3816 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/__templates__/agent/scripts/setup.shView on unpkg

lib/__templates__/expo/.licosproj/scripts/server_dev_run.shView file

•path = lib/__templates__/expo/.licosproj/scripts/server_dev_run.sh kind = payload_in_excluded_dir sizeBytes = 1743 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

lib/__templates__/expo/.licosproj/scripts/server_dev_run.shView on unpkg

Findings

5 High5 Medium4 Low

HighChild Processlib/__templates__/expo/template.config.js

HighShelllib/cli.js

HighCommand Output Exfiltrationlib/cli.js

HighRuntime Package Installlib/__templates__/expo/client/scripts/install-missing-deps.js

HighPayload In Excluded Dirlib/__templates__/expo/.licosproj/scripts/server_dev_run.sh

MediumDynamic Requirelib/__templates__/expo/server/build.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperlib/__templates__/agent/scripts/setup.sh

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

7 flagged

lib/__templates__/expo/template.config.jsView file

Lines 1-22javascript

3import { spawn } from 'child_process';

4import { resolve, join, basename, dirname } from 'path';

High

Child Process

Package source references child process execution.

lib/__templates__/expo/template.config.jsView on unpkg · L2

5import { appendFileSync, openSync, closeSync, mkdirSync } from 'fs';

6import { fileURLToPath } from 'url';

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = dirname(__filename);

16export const paramsSchema = {

17 type: 'object',

18 properties: {

19 appName: {

20 type: 'string',

21 minLength: 1,

22 pattern: '^[a-z0-9-]+$',

lib/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2'use strict';

4var commander = require('commander');

5var path = require('path');

6var fs = require('fs');

7var debug =

lib/__templates__/expo/server/build.jsView file

Lines 1-22javascript

1import * as esbuild from 'esbuild';

2import { createRequire } from 'module';

4const require = createRequire(import.meta.url);

5const pkg

lib/__templates__/expo/client/scripts/install-missing-deps.jsView file

Lines 62-102javascript

63 if (missingPackages.length === 0) {

64 console.log('没有发现缺失的依赖');

65 process.exit(0);

66 }

68 console.log('发现以下缺失的依赖：');

lib/__templates__/agent/scripts/setup.shView file

•path = lib/__templates__/agent/scripts/setup.sh kind = build_helper sizeBytes = 3816 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/__templates__/agent/scripts/setup.shView on unpkg

lib/__templates__/expo/.licosproj/scripts/server_dev_run.shView file

•path = lib/__templates__/expo/.licosproj/scripts/server_dev_run.sh kind = payload_in_excluded_dir sizeBytes = 1743 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

lib/__templates__/expo/.licosproj/scripts/server_dev_run.shView on unpkg

Lines 2656-2696javascript

2656 throw new Error(`Template directory not found: ${templatePath}`);

2657 }

2658

2659 return templatePath;

2660};

2661

2662/**

2663 * 对单个模板执行 pnpm install

2664 */

2665const warmupTemplate = (templatePath, templateName) => {

2666 logger.info(`\nWarming up template: ${templateName}`);

2667 logger.info(` Path: ${templatePath}`);

2668

2669 // 检查是否存在 package.json

2670 const packageJsonPath = node_path.join(templatePath, 'package.json');

2671 // eslint-disable-next-line security/detect-non-literal-fs-filename

2672 if (!node_fs.existsSync(packageJsonPath)) {

2673 logger.info(` ⊘ Skipping ${templateName} (no package.json found)`);

2674 return;

2675 }

2676

2677 const result = shelljs.exec(

2678 'pnpm install --registry=https://registry.npmmirror.com --prefer-frozen-lockfile --prefer-offline --reporter=append-only',

2679 {

2680 cwd: templatePath,

2681 silent: true,

2682 },

2683 );

2684

2685 // 输出 stdout

2686 if (result.stdout) {

2687 process.stdout.write(result.stdout);

2688 }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/cli.jsView on unpkg · L2676

2689

2690 // 输出 stderr

2691 if (result.stderr) {

2692 process.stderr.write(result.stderr);

2693 }

2694

2695 if (result.code === 0) {

2696 logger.success(` ✓ ${templateName} warmed up successfully`);