registry / Credential exfiltration / @nocobase/cli-v1 / 2.2.30

@nocobase/cli-v1@2.2.30

AI Security Review

scanned 15h ago · by lpm-firewall-ai

The package has a concrete credential-forwarding risk when its package URL or returned tarball URL is untrusted. The explicit command and package-service default limit the concern, but the source does not bind credentials or the token to an approved destination.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user runs `pkg download-pro` with a saved license key or package credentials available.

Impact

If the endpoint or tarball host is not trusted, credentials or the resulting token could reach an unintended recipient.

Mechanism

The command uses `NOCOBASE_PKG_URL` or its default, posts credentials to its login route, then uses the resulting bearer token for metadata and the metadata-selected tarball request.

AI rationale

Evidence

src/commands/pkg.jssrc/license.js

Network endpoints1

pkg.nocobase.com/

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit `pkg download-pro` command can load an environment-bound saved license key or credentials from environment variables.
The command accepts an unrestricted `NOCOBASE_PKG_URL` override and passes the selected credentials to that endpoint’s login route.
The returned bearer token is sent to the metadata endpoint and to the tarball URL supplied by that metadata, without destination validation.

Evidence against

The credential transfer requires the user to invoke `pkg download-pro` and provide credentials or have a saved license key; the default endpoint is the NocoBase package service.
The source checks that a saved license key matches the current environment before using it.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

11 flagged

src/commands/e2e.jsView file

11const { run, isPortReachable, checkDBDialect, storagePathJoin } = require('../util'); L12: const { execSync } = require('node:child_process'); L13: const axios = require('axios');

High

Child Process

Package source references child process execution.

src/commands/e2e.jsView on unpkg · L11

123try { L124: execSync( L125: `npx playwright codegen --load-storage=${authFile} ${process.env.APP_BASE_URL} --save-storage=${authFile}`, L126: commonConfig,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/e2e.jsView on unpkg · L123

•matchType = normalized_sha256 matchedPackage = @nocobase/cli-v1@2.2.15 matchedPath = src/commands/e2e.js matchedIdentity = npm:QG5vY29iYXNlL2NsaS12MQ:2.2.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/e2e.jsView on unpkg

src/util.jsView file

11const chalk = require('chalk'); L12: const execa = require('execa'); L13: const fg = require('fast-glob');

High

Shell

Package source references shell execution.

src/util.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @nocobase/cli-v1@2.2.15 matchedPath = src/util.js matchedIdentity = npm:QG5vY29iYXNlL2NsaS12MQ:2.2.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/util.jsView on unpkg

247const { stdout } = await execa('npm', ['v', '@nocobase/app-server', 'versions']); L248: const versions = new Function(`return (${stdout})`)(); L249: return versions[versions.length - 1];

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/util.jsView on unpkg · L247

bin/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const chalk = require('chalk');

4const { initEnv, genTsConfigPaths } = require('../src/util');

Medium

src/commands/app-dev-utils.jsView file

•matchType = normalized_sha256 matchedPackage = @nocobase/cli-v1@2.2.15 matchedPath = src/commands/app-dev-utils.js matchedIdentity = npm:QG5vY29iYXNlL2NsaS12MQ:2.2.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/app-dev-utils.jsView on unpkg

src/commands/dev.jsView file

•matchType = normalized_sha256 matchedPackage = @nocobase/cli-v1@2.2.15 matchedPath = src/commands/dev.js matchedIdentity = npm:QG5vY29iYXNlL2NsaS12MQ:2.2.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/dev.jsView on unpkg

src/commands/pkg.jsView file

•matchType = normalized_sha256 matchedPackage = @nocobase/cli-v1@2.2.15 matchedPath = src/commands/pkg.js matchedIdentity = npm:QG5vY29iYXNlL2NsaS12MQ:2.2.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/pkg.jsView on unpkg

src/commands/create-nginx-conf.jsView file

•matchType = normalized_sha256 matchedPackage = @nocobase/cli-v1@2.2.15 matchedPath = src/commands/create-nginx-conf.js matchedIdentity = npm:QG5vY29iYXNlL2NsaS12MQ:2.2.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/create-nginx-conf.jsView on unpkg

Source & flagged code

11 flagged · loading source

src/commands/e2e.jsView file

11const { run, isPortReachable, checkDBDialect, storagePathJoin } = require('../util'); L12: const { execSync } = require('node:child_process'); L13: const axios = require('axios');

High

Child Process

Package source references child process execution.

src/commands/e2e.jsView on unpkg · L11

123try { L124: execSync( L125: `npx playwright codegen --load-storage=${authFile} ${process.env.APP_BASE_URL} --save-storage=${authFile}`, L126: commonConfig,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/e2e.jsView on unpkg · L123

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/e2e.jsView on unpkg

Findings

9 High4 Medium4 Low

HighChild Processsrc/commands/e2e.js

HighShellsrc/util.js

HighRuntime Package Installsrc/commands/e2e.js

HighKnown Malware Source Similaritysrc/commands/e2e.js

HighKnown Malware Source Similaritysrc/commands/app-dev-utils.js

HighKnown Malware Source Similaritysrc/commands/dev.js

HighKnown Malware Source Similaritysrc/commands/pkg.js

HighKnown Malware Source Similaritysrc/util.js

HighKnown Malware Source Similaritysrc/commands/create-nginx-conf.js

MediumDynamic Requirebin/index.js

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to @nocobase/cli-v1@2.2.30.

See all versions of @nocobase/cli-v1 for other recorded verdicts.

Review the evidence and your use of @nocobase/cli-v1@2.2.30 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 10:55:55.836Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.