registry / @lark-project/cli / 2.8.0

@lark-project/cli@2.8.0

飞书项目插件开发工具

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 194 file(s), 834 KB of source, external domains: meegle.com, meego.example.com, nodejs.org, project.feishu.cn, r.cnpmjs.org, registry.npmjs.org, registry.npmmirror.com, sf3-cn.feishucdn.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 1-52json

2 "name": "@lark-project/cli",

3 "version": "2.8.0",

4 "main": "lib/index.js",

5 "bin": {

6 "lpm": "./bin/index.js"

7 },

8 "files": [

9 "/bin",

10 "/lib",

11 "/schema",

12 "/skills",

13 "/scripts/install-skills.js",

14 "/scripts/uninstall-skills.js"

15 ],

16 "engines": {

17 "node": ">=16.0.0"

18 },

19 "license": "MIT",

20 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L20

21 "commit": "commit",

22 "downloadTemplate": "node scripts/download-github-template/index.js",

23 "build": "rm -rf lib && tspc && yarn downloadTemplate",

24 "watch": "rm -rf lib && yarn downloadTemplate && tspc --watch",

25 "test": "jest --coverage=false",

26 "test:cov": "jest",

27 "release": "semantic-release",

28 "prepublishOnly": "yarn build",

29 "postpublish": "bnpm sync @lark-project/cli",

30 "commitlint": "commitlint --edit",

31 "prepare": "husky",

32 "postinstall": "node ./scripts/install-skills.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 "preuninstall": "node ./scripts/uninstall-skills.js",

34 "conformance": "npx -y tsx@^4 src/utils/point-eval/conformance/cli.ts",

35 "schema-eval": "npx -y tsx@^4 eval/scripts/run-schema-eval.ts"

36 },

37 "keywords": [

38 "飞书项目",

39 "Lark Project"

40 ],

41 "description": "飞书项目插件开发工具",

42 "devDependencies": {

43 "@commitlint/cli": "^17.8.1",

44 "@commitlint/config-conventional": "^17.8.1",

45 "@semantic-release/git": "^10.0.1",

46 "@testing-library/jest-dom": "^6.4.2",

47 "@testing-library/react": "^14.2.1",

48 "@testing-library/react-hooks": "^8.0.1",

49 "@types/case-sensitive-paths-webpack-plugin": "^2.1.9",

50 "@types/cross-spawn": "^6.0.2",

51 "@types/ejs": "^3.1.2",

52 "@types/figlet": "^1.5.5",

scripts/uninstall-skills.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * preuninstall 钩子：卸载 CLI 时同步移除已注册的 skills。

4 *

5 * 解析 `skills` 可执行文件的优先级（无网络最稳 → 最兜底）：

6 * 1. optionalDependency 拉到的 node_modules/skills/bin

7 * 2. 全局 PATH 上的 `skills` 命令

8 * 3. `npx --yes skills`（让 npx 自己读用户的 npm 配置，不强制覆盖）

9 *

10 * 卸载阶段任何失败都静默，不阻断卸载，不给用户添乱。

11 */

lib/v1/utils/index.jsView file

Lines 5-45javascript

5 if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {

6 desc = { enumerable: true, get: function() { return m[k]; } };

7 }

8 Object.defineProperty(o, k2, desc);

lib/v1/plugin/HotUpdatePlugin.jsView file

Lines 11-51javascript

11 const config = model_1.ConfigFactory.getConfig(types_1.EConfigType.Plugin);

12 const plugin_id = (_a = config.get('pluginID', false)) !== null && _a !== void 0 ? _a

bin/index.jsView file

Lines 1-3javascript

1#!/usr/bin/env node

2require('../lib/cli.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/index.jsView on unpkg · L1

lib/utils/check-latest-version.jsView file

Lines 31-71javascript

31 const { lastLatestCheckAt, lastLatestCheckFailedAt } = (0, settings_1.loadSettings)();

32 const freshSuccess = lastLatestCheckAt != null && now - lastLatestCheckAt < LATEST_TTL_MS;

33 const freshFailure

lib/template/v2.zipView file

•path = lib/template/v2.zip kind = high_entropy_blob sizeBytes = 562713 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/template/v2.zipView on unpkg

•path = lib/template/v2.zip kind = compressed_blob sizeBytes = 562713 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/template/v2.zipView on unpkg

•path = lib/template/v2.zip kind = nested_archive_needs_inspection sizeBytes = 562713 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/template/v2.zipView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•dependencies registry_only=skills

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/install-skills.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/uninstall-skills.jsView file

14L15: const { spawn, execSync } = require('child_process'); L16: const path = require('path');

High

Child Process

Package source references child process execution.

scripts/uninstall-skills.jsView on unpkg · L14

lib/v1/utils/index.jsView file

25const ora_1 = __importDefault(require("ora")); L26: const execa_1 = __importDefault(require("execa")); L27: const fs_extra_1 = __importDefault(require("fs-extra"));

High

Shell

Package source references shell execution.

lib/v1/utils/index.jsView on unpkg · L25

lib/v1/plugin/HotUpdatePlugin.jsView file

31try { L32: return eval('(' + moreModules[moduleId].toString() + ')') L33: } catch(e) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/v1/plugin/HotUpdatePlugin.jsView on unpkg · L31

bin/index.jsView file

1#!/usr/bin/env node L2: require('../lib/cli.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/index.jsView on unpkg · L1

lib/utils/check-latest-version.jsView file

51try { L52: const result = shelljs_1.default.exec('npm install -g @lark-project/cli@latest'); L53: if (result.code !== 0) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/utils/check-latest-version.jsView on unpkg · L51

lib/template/v2.zipView file

•path = lib/template/v2.zip kind = high_entropy_blob sizeBytes = 562713 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/template/v2.zipView on unpkg

•path = lib/template/v2.zip kind = compressed_blob sizeBytes = 562713 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/template/v2.zipView on unpkg

•path = lib/template/v2.zip kind = nested_archive_needs_inspection sizeBytes = 562713 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/template/v2.zipView on unpkg

Findings

1 Critical5 High6 Medium7 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/uninstall-skills.js

HighShelllib/v1/utils/index.js

HighRuntime Package Installlib/utils/check-latest-version.js

HighShips High Entropy Bloblib/template/v2.zip

MediumDynamic Requirebin/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Bloblib/template/v2.zip

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvallib/v1/plugin/HotUpdatePlugin.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionlib/template/v2.zip

Source & flagged code

10 flagged

package.jsonView file

Lines 1-52json

2 "name": "@lark-project/cli",

3 "version": "2.8.0",

4 "main": "lib/index.js",

5 "bin": {

6 "lpm": "./bin/index.js"

7 },

8 "files": [

9 "/bin",

10 "/lib",

11 "/schema",

12 "/skills",

13 "/scripts/install-skills.js",

14 "/scripts/uninstall-skills.js"

15 ],

16 "engines": {

17 "node": ">=16.0.0"

18 },

19 "license": "MIT",

20 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L20

21 "commit": "commit",

22 "downloadTemplate": "node scripts/download-github-template/index.js",

23 "build": "rm -rf lib && tspc && yarn downloadTemplate",

24 "watch": "rm -rf lib && yarn downloadTemplate && tspc --watch",

25 "test": "jest --coverage=false",

26 "test:cov": "jest",

27 "release": "semantic-release",

28 "prepublishOnly": "yarn build",

29 "postpublish": "bnpm sync @lark-project/cli",

30 "commitlint": "commitlint --edit",

31 "prepare": "husky",

32 "postinstall": "node ./scripts/install-skills.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 "preuninstall": "node ./scripts/uninstall-skills.js",

34 "conformance": "npx -y tsx@^4 src/utils/point-eval/conformance/cli.ts",

35 "schema-eval": "npx -y tsx@^4 eval/scripts/run-schema-eval.ts"

36 },

37 "keywords": [

38 "飞书项目",

39 "Lark Project"

40 ],

41 "description": "飞书项目插件开发工具",

42 "devDependencies": {

43 "@commitlint/cli": "^17.8.1",

44 "@commitlint/config-conventional": "^17.8.1",

45 "@semantic-release/git": "^10.0.1",

46 "@testing-library/jest-dom": "^6.4.2",

47 "@testing-library/react": "^14.2.1",

48 "@testing-library/react-hooks": "^8.0.1",

49 "@types/case-sensitive-paths-webpack-plugin": "^2.1.9",

50 "@types/cross-spawn": "^6.0.2",

51 "@types/ejs": "^3.1.2",

52 "@types/figlet": "^1.5.5",

scripts/uninstall-skills.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * preuninstall 钩子：卸载 CLI 时同步移除已注册的 skills。

4 *

5 * 解析 `skills` 可执行文件的优先级（无网络最稳 → 最兜底）：

6 * 1. optionalDependency 拉到的 node_modules/skills/bin

7 * 2. 全局 PATH 上的 `skills` 命令

8 * 3. `npx --yes skills`（让 npx 自己读用户的 npm 配置，不强制覆盖）

9 *

10 * 卸载阶段任何失败都静默，不阻断卸载，不给用户添乱。

11 */

lib/v1/utils/index.jsView file

Lines 5-45javascript

5 if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {

6 desc = { enumerable: true, get: function() { return m[k]; } };

7 }

8 Object.defineProperty(o, k2, desc);

lib/v1/plugin/HotUpdatePlugin.jsView file

Lines 11-51javascript

11 const config = model_1.ConfigFactory.getConfig(types_1.EConfigType.Plugin);

12 const plugin_id = (_a = config.get('pluginID', false)) !== null && _a !== void 0 ? _a

bin/index.jsView file

Lines 1-3javascript

1#!/usr/bin/env node

2require('../lib/cli.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/index.jsView on unpkg · L1

lib/utils/check-latest-version.jsView file

Lines 31-71javascript

31 const { lastLatestCheckAt, lastLatestCheckFailedAt } = (0, settings_1.loadSettings)();

32 const freshSuccess = lastLatestCheckAt != null && now - lastLatestCheckAt < LATEST_TTL_MS;

33 const freshFailure

lib/template/v2.zipView file

•path = lib/template/v2.zip kind = high_entropy_blob sizeBytes = 562713 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/template/v2.zipView on unpkg

•path = lib/template/v2.zip kind = compressed_blob sizeBytes = 562713 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

lib/template/v2.zipView on unpkg

•path = lib/template/v2.zip kind = nested_archive_needs_inspection sizeBytes = 562713 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

lib/template/v2.zipView on unpkg