@nocobase/cli-v1@2.2.15
<video width="100%" controls> <source src="https://github.com/user-attachments/assets/4d11a87b-00e2-48f3-9bf7-389d21072d13" type="video/mp4"> </video>
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe startup deletion is an unguarded destructive side effect on the consumer’s plugin storage. Although compatibility cleanup is possible, the inspected source provides no condition or explanation that resolves that risk.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Invoking either CLI binary, before the requested command is parsed.
Impact
Installed plugin files and functionality may be lost.
Mechanism
Startup initialization recursively removes four hard-coded directories from plugin storage without a command-specific check or consent guard.
Attack narrative
Before command parsing, the executable runs initialization that recursively deletes four named plugin directories from plugin storage. Because this occurs for any CLI invocation, an otherwise unrelated command can remove installed plugin files.
AI rationale
The startup deletion is an unguarded destructive side effect on the consumer’s plugin storage. Although compatibility cleanup is possible, the inspected source provides no condition or explanation that resolves that risk.
Evidence
bin/index.jssrc/util.js
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- The executable calls environment initialization before parsing CLI arguments.
- Initialization sets the plugin storage location under the configured storage root.
- Initialization recursively removes four named plugin directories without checking the selected command.
Evidence against
- The deletion is limited to four named NocoBase plugin directories, which could reflect compatibility cleanup, but the source does not guard it or explain that purpose.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcesrc/commands/e2e.jsView file
11const { run, isPortReachable, checkDBDialect, storagePathJoin } = require('../util');
L12: const { execSync } = require('node:child_process');
L13: const axios = require('axios');
High
Child Process
Package source references child process execution.
src/commands/e2e.jsView on unpkg · L11123try {
L124: execSync(
L125: `npx playwright codegen --load-storage=${authFile} ${process.env.APP_BASE_URL} --save-storage=${authFile}`,
L126: commonConfig,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
src/commands/e2e.jsView on unpkg · L123src/util.jsView file
11const chalk = require('chalk');
L12: const execa = require('execa');
L13: const fg = require('fast-glob');
High
Findings
1 Critical3 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltasrc/commands/dev.js
HighChild Processsrc/commands/e2e.js
HighShellsrc/util.js
HighRuntime Package Installsrc/commands/e2e.js
MediumDynamic Requirebin/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEvalsrc/util.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @nocobase/cli-v1@2.2.15.
See all versions of @nocobase/cli-v1 for other recorded verdicts.
- Avoid installing @nocobase/cli-v1@2.2.15. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.