Loading npm security reports…

@leju-gym/gym-cli@0.0.16: Suspicious npm security report (Warn) | LPM Firewall

registry / @leju-gym/gym-cli / 0.0.16

@leju-gym/gym-cli@0.0.16

⚠ Under review

Gym CLI - 数据管理命令行工具

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 196 KB of source, external domains: dev.lejugym.com, oss-cn-hangzhou.aliyuncs.com, test.lejugym.com, www.lejugym.com

Source & flagged code

5 flagged

bin/gym.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * gym CLI 入口（npm 安装方式）

4 *

5 * 启动时检查 PATH 中是否存在旧版 gym 二进制残留（历史上通过 install.sh/install.bat

6 * 安装的 pkg 编译产物，落在 /usr/local/bin/gym、~/bin/gym 等）。这类残留常落在 PATH

7 * 靠前位置，盖过 npm 符号链接，导致用户实际跑的是旧版。检测到时提示下载清理脚本，

8 * 之后用 ~/.gym/.migration-warned 标记，不再骚扰。

9 *

10 * 本守卫自包含（不依赖 dist bundle 内部模块），因为 bin/gym.js 作为 npm bin 入口原样发布，

11 * 不参与 esbuild 打包。清理请使用 migration/ 目录下的平台清理脚本。

12 *

13 * 注意：本守卫不自动删任何文件，仅提示用户下载清理脚本。

14 */

15const fs = require("fs");

16const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/gym.jsView on unpkg · L14

17const os = require("os");

18const { execSync } = require("child_process");

19const { pathToFileURL } = require("url");

High

Child Process

Package source references child process execution.

bin/gym.jsView on unpkg · L17

21// pkg 编译的独立二进制入口不是本文件；若误以 bin/gym.js 为入口执行，直接放行不报残留。

22if (process.pkg) {

23 try {

24 require("../dist/gym.cjs");

25 } catch (e) {

26 console.error("Failed to start:", e);

27 process.exit(1);

28 }

29 return;

30}

32const warnedFile = path.join(os.homedir(), ".gym", ".migration-warned");

34// 首次警告标记：已提示过或被环境变量/参数关闭则静默

35const skipWarn =

36 process.env.GYM_NO_MIGRATION_WARN === "1" ||

37 process.argv.includes("--no-warn") ||

dist/gym.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2var vs=Object.defineProperty;var An=(t,e,n)=>()=>{if(n)throw n[0];try{

Source & flagged code

5 flagged · loading source

bin/gym.jsView file

17const os = require("os"); L18: const { execSync } = require("child_process"); L19: const { pathToFileURL } = require("url");

High

Child Process

Package source references child process execution.

bin/gym.jsView on unpkg · L17

14*/ L15: const fs = require("fs"); L16: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/gym.jsView on unpkg · L14

dist/gym.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @leju-gym/gym-cli@0.0.14 matchedIdentity = npm:QGxlanUtZ3ltL2d5bS1jbGk:0.0.14 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/gym.mjs

Findings

1 Critical4 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/gym.mjs

HighChild Processbin/gym.js

HighSame File Env Network Executiondist/gym.mjs

HighCommand Output Exfiltrationdist/gym.mjs

HighObfuscated

MediumDynamic Requirebin/gym.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings