@leju-gym/gym-cli@0.0.2: Suspicious npm security report (Warn)

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.76 MB of source, external domains: dev.lejugym.com, feross.org, github.com, oss-cn-hangzhou.aliyuncs.com, reactjs.org, test.lejugym.com, www.lejugym.com

Source & flagged code

6 flagged

bin/gym.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @leju-gym/gym-cli@0.0.1 matchedIdentity = npm:QGxlanUtZ3ltL2d5bS1jbGk:0.0.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/gym.jsView on unpkg

17const os = require("os"); L18: const { execSync } = require("child_process"); L19:

High

Child Process

Package source references child process execution.

bin/gym.jsView on unpkg · L17

dist/gym.cjsView file

13Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(r):this._lifeCycleHooks[e]=[r],this}exitOverride(e){return e?this._exitCallback=e... L14: - already used by option '${r.flags}'`)}this.options.push(e)}_registerCommand(e){let r=i=>[i.name()].concat(i.aliases()),n=r(e).find(i=>this._findCommand(i));if(n){let i=r(this._f... L15: - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

High

Shell

Package source references shell execution.

dist/gym.cjsView on unpkg · L13

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}E4.suggestSimilar=zV});var w4=_(b4=>{var VV=Tt("node:events").EventEmitter,U2=Tt("node:child_process"),Ul=Tt("node:path"),G2=Tt("node:fs"),Ei=Tt("node:p... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma... ... L22: Expecting one of '${n.join("', '")}'`);let i=`${e}Help`;return this.on(i,s=>{let u;typeof r=="function"?u=r({error:s.error,command:s.command}):u=r,u&&s.write(`${u} L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(i=>r.is(i))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function B4(t){r... L24: Calls to async() callback can have unexpected results.`),x=!0,function(G,J){G?D(G):d(J)})},R;i&&r&&Proxy?R=new Proxy(i,{get(G,J){return J===r?(J in G&&console.warn(`${r} property i...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/gym.cjsView on unpkg · L10

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}E4.suggestSimilar=zV});var w4=_(b4=>{var VV=Tt("node:events").EventEmitter,U2=Tt("node:child_process"),Ul=Tt("node:path"),G2=Tt("node:fs"),Ei=Tt("node:p... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma... ... L22: Expecting one of '${n.join("', '")}'`);let i=`${e}Help`;return this.on(i,s=>{let u;typeof r=="function"?u=r({error:s.error,command:s.command}):u=r,u&&s.write(`${u} L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(i=>r.is(i))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function B4(t){r... L24: Calls to async() callback can have unexpected results.`),x=!0,function(G,J){G?D(G):d(J)})},R;i&&r&&Proxy?R=new Proxy(i,{get(G,J){return J===r?(J in G&&console.warn(`${r} property i...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/gym.cjsView on unpkg · L10

383L384: `),i=(0,cj.createParsers)({definitions:t,topLevelReaderKey:r}),s=new Function("deserializers","builtinSizes","typeReaders","StandardTypeReader",`${n} L385: return __RootMsg;`),u=s.call(void 0,AC.deserializers,Aj,i,cj.StandardTypeReader);return u.source=()=>s.toString(),u}});var dj=_(Vh=>{"use strict";var XIe=Vh&&Vh.__importDefault||fu...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/gym.cjsView on unpkg · L383

Source & flagged code

6 flagged · loading source

bin/gym.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @leju-gym/gym-cli@0.0.1 matchedIdentity = npm:QGxlanUtZ3ltL2d5bS1jbGk:0.0.1 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/gym.jsView on unpkg

17const os = require("os"); L18: const { execSync } = require("child_process"); L19:

High

Child Process

Package source references child process execution.

bin/gym.jsView on unpkg · L17

dist/gym.cjsView file

13Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(r):this._lifeCycleHooks[e]=[r],this}exitOverride(e){return e?this._exitCallback=e... L14: - already used by option '${r.flags}'`)}this.options.push(e)}_registerCommand(e){let r=i=>[i.name()].concat(i.aliases()),n=r(e).find(i=>this._findCommand(i));if(n){let i=r(this._f... L15: - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

Findings

1 Critical5 High4 Medium6 Low

CriticalPrevious Version Dangerous Deltabin/gym.js

HighChild Processbin/gym.js

HighShelldist/gym.cjs

HighSame File Env Network Executiondist/gym.cjs

HighCommand Output Exfiltrationdist/gym.cjs

HighObfuscated

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/gym.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings