registry / @simonyea/holysheep-cli / 2.1.105

@simonyea/holysheep-cli@2.1.105

⚠ Under review

Claude Code/Cursor/Cline API relay for China — ¥1=$1, WeChat/Alipay payment, no credit card, no VPN. One command setup for all AI coding tools.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 718 KB of source, external domains: 127.0.0.1, aistudio.google.com, api.holysheep.ai, app.factory.ai, bun.sh, claude.ai, developers.openai.com, docs.anthropic.com, docs.factory.ai, docs.openclaw.ai, gitee.com, github.com, hermes-agent.nousresearch.com, holysheep.ai, mail.holysheep.ai, nodejs.org, opencode.ai, qwenlm.github.io, raw.githubusercontent.com, registry.npmjs.org, registry.npmmirror.com, www.codebuddy.ai, www.holysheep.ai

Source & flagged code

11 flagged

dist/configure-worker.jsView file

Lines 1-34javascript

1"use strict";

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __name = (target, value) => __defProp(target, "name", { value, configurable: true });

5var __commonJS = (cb, mod) => function __require() {

6 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

7};

9// src/utils/config.js

10var require_config = __commonJS({

11 "src/utils/config.js"(exports2, module2) {

12 var fs = require("fs");

13 var path = require("path");

14 var os = require("os");

15 var CONFIG_DIR = path.join(os.homedir(), ".holysheep");

16 var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");

17 var BASE_URL_ANTHROPIC = "https://api.holysheep.ai";

18 var BASE_URL_OPENAI = "https://api.holysheep.ai/v1";

19 var BASE_URL_CLAUDE_RELAY = process.env.HOLYSHEEP_CLAUDE_RELAY_URL || "https://api.holysheep.ai/claude-relay";

20 var SHOP_URL = "https://holysheep.ai";

21 function ensureDir() {

22 if (!fs.existsSync(CONFIG_DIR)) {

23 fs.mkdirSync(CONFIG_DIR, { recursive: true });

24 }

25 }

26 __name(ensureDir, "ensureDir");

27 function loadConfig() {

28 try {

29 if (fs.existsSync(CONFIG_FILE)) {

30 return JSON.parse(fs.readFileSync(CONFIG_FILE, "utf8"));

31 }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/configure-worker.jsView on unpkg · L14

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/configure-worker.jsView on unpkg · L14

32 } catch {

33 }

34 return {};

Lines 1062-1102javascript

1062 getControlPlaneUrl,

1063 readConfig,

1064 sanitizeClaudeClientHeaders,

1065 startProcessProxy,

1066 writeConfig,

1067 ORIGINAL_CLAUDE_USER_AGENT_HEADER,

1068 LOCAL_PING_PATH,

1069 LOCAL_PING_HEADER,

1070 LOCAL_PING_HEADER_VALUE,

1071 _private: {

1072 fetchFreshLease

Lines 1134-1174javascript

1134 function checkKnownPathsSync(cmd) {

1135 for (const p of getWindowsKnownPaths(cmd)) {

1136 try {

1137 if (fs.existsSync(p)) {

1138 appendDirToProcessPath(path.dirname(p));

1139 return p;

3325if (hasNpx()) { L3326: return { cmd: "npx", argsPrefix: ["openclaw"], shell: isWin, label: "npx openclaw", via: "npx" }; L3327: } ... L3334: function runWithRunner(runner, args, opts = {}) { L3335: return spawnSync(runner.cmd, [...runner.argsPrefix, ...args], { L3336: shell: runner.shell,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/configure-worker.jsView on unpkg · L3325

dist/index.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2"use strict";

3var __defProp = Object.defineProperty;

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __name = (target, value) => __defProp(target, "name", { value, configurable: true });

6var

dist/pty-hermes-wrapper.pyView file

•path = dist/pty-hermes-wrapper.py kind = build_helper sizeBytes = 6726 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/pty-hermes-wrapper.pyView on unpkg

Source & flagged code

11 flagged · loading source

dist/configure-worker.jsView file

1082var fs = require("fs"); L1083: var { exec, execSync, execFileSync } = require("child_process"); L1084: function canRun(command, options = {}) {

High

Child Process

Package source references child process execution.

dist/configure-worker.jsView on unpkg · L1082

1154const out = execFileSync( L1155: "powershell.exe", L1156: ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", "[Environment]::GetEnvironmentVariable('Path', 'User')"],

High

Shell

Package source references shell execution.

dist/configure-worker.jsView on unpkg · L1154

14Cross-file remote execution chain: dist/configure-worker.js spawns dist/process-proxy-inject.js; helper contains network access plus dynamic code execution. L14: var os = require("os"); L15: var CONFIG_DIR = path.join(os.homedir(), ".holysheep"); L16: var CONFIG_FILE = path.join(CONFIG_DIR, "config.json"); L17: var BASE_URL_ANTHROPIC = "https://api.holysheep.ai"; L18: var BASE_URL_OPENAI = "https://api.holysheep.ai/v1"; L19: var BASE_URL_CLAUDE_RELAY = process.env.HOLYSHEEP_CLAUDE_RELAY_URL || "https://api.holysheep.ai/claude-relay"; L20: var SHOP_URL = "https://holysheep.ai"; ... L29: if (fs.existsSync(CONFIG_FILE)) { L30: return JSON.parse(fs.readFileSync(CONFIG_FILE, "utf8")); L31: } ... L280: headers: { "content-type": "application/json" }, L281: body: JSON.stringify(requestBody)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/configure-worker.jsView on unpkg · L14

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/configure-worker.jsView on unpkg · L3325

14var os = require("os"); L15: var CONFIG_DIR = path.join(os.homedir(), ".holysheep"); L16: var CONFIG_FILE = path.join(CONFIG_DIR, "config.json"); L17: var BASE_URL_ANTHROPIC = "https://api.holysheep.ai"; L18: var BASE_URL_OPENAI = "https://api.holysheep.ai/v1"; L19: var BASE_URL_CLAUDE_RELAY = process.env.HOLYSHEEP_CLAUDE_RELAY_URL || "https://api.holysheep.ai/claude-relay"; L20: var SHOP_URL = "https://holysheep.ai"; ... L29: if (fs.existsSync(CONFIG_FILE)) { L30: return JSON.parse(fs.readFileSync(CONFIG_FILE, "utf8")); L31: } ... L280: headers: { "content-type": "application/json" }, L281: body: JSON.stringify(requestBody)

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/configure-worker.jsView on unpkg · L14

dist/index.jsView file

7399var os = require("os"); L7400: var http = require("http"); L7401: var { spawn, execSync, execFileSync } = require("child_process"); L7402: var chalk2 = require("chalk"); ... L7414: var { getApiKey } = require_config(); L7415: var HS_DIR = process.env.HOLYSHEEP_DIR || path.join(os.homedir(), ".holysheep"); L7416: var PID_FILE = path.join(HS_DIR, "claude-proxy.pid");

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L7399

9L10: // package.json L11: var require_package = __commonJS({ ... L61: ], L62: homepage: "https://holysheep.ai", L63: repository: { ... L106: var os = require("os"); L107: var CONFIG_DIR = path.join(os.homedir(), ".holysheep"); L108: var CONFIG_FILE = path.join(CONFIG_DIR, "config.json"); ... L110: var BASE_URL_OPENAI = "https://api.holysheep.ai/v1"; L111: var BASE_URL_CLAUDE_RELAY = process.env.HOLYSHEEP_CLAUDE_RELAY_URL || "https://api.holysheep.ai/claude-relay"; L112: var SHOP_URL = "https://holysheep.ai";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L9

9Trigger-reachable chain: manifest.main -> dist/index.js L9: L10: // package.json L11: var require_package = __commonJS({ ... L61: ], L62: homepage: "https://holysheep.ai", L63: repository: { ... L106: var os = require("os"); L107: var CONFIG_DIR = path.join(os.homedir(), ".holysheep"); L108: var CONFIG_FILE = path.join(CONFIG_DIR, "config.json"); ... L110: var BASE_URL_OPENAI = "https://api.holysheep.ai/v1"; L111: var BASE_URL_CLAUDE_RELAY = process.env.HOLYSHEEP_CLAUDE_RELAY_URL || "https://api.holysheep.ai/claude-relay"; L112: var SHOP_URL = "https://holysheep.ai";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L9

•matchType = previous_version_dangerous_delta matchedPackage = @simonyea/holysheep-cli@2.1.103 matchedIdentity = npm:QHNpbW9ueWVhL2hvbHlzaGVlcC1jbGk:2.1.103 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L9

dist/pty-hermes-wrapper.pyView file

•path = dist/pty-hermes-wrapper.py kind = build_helper sizeBytes = 6726 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/pty-hermes-wrapper.pyView on unpkg

Findings

4 Critical5 High5 Medium5 Low

CriticalSame File Env Network Executiondist/index.js

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/configure-worker.js

HighShelldist/configure-worker.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCross File Remote Execution Contextdist/configure-worker.js

HighRuntime Package Installdist/configure-worker.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/configure-worker.js

MediumShips Build Helperdist/pty-hermes-wrapper.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

dist/configure-worker.jsView file

Lines 1-34javascript

1"use strict";

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __name = (target, value) => __defProp(target, "name", { value, configurable: true });

5var __commonJS = (cb, mod) => function __require() {

6 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

7};

9// src/utils/config.js

10var require_config = __commonJS({

11 "src/utils/config.js"(exports2, module2) {

12 var fs = require("fs");

13 var path = require("path");

14 var os = require("os");

15 var CONFIG_DIR = path.join(os.homedir(), ".holysheep");

16 var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");

17 var BASE_URL_ANTHROPIC = "https://api.holysheep.ai";

18 var BASE_URL_OPENAI = "https://api.holysheep.ai/v1";

19 var BASE_URL_CLAUDE_RELAY = process.env.HOLYSHEEP_CLAUDE_RELAY_URL || "https://api.holysheep.ai/claude-relay";

20 var SHOP_URL = "https://holysheep.ai";

21 function ensureDir() {

22 if (!fs.existsSync(CONFIG_DIR)) {

23 fs.mkdirSync(CONFIG_DIR, { recursive: true });

24 }

25 }

26 __name(ensureDir, "ensureDir");

27 function loadConfig() {

28 try {

29 if (fs.existsSync(CONFIG_FILE)) {

30 return JSON.parse(fs.readFileSync(CONFIG_FILE, "utf8"));

31 }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/configure-worker.jsView on unpkg · L14

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/configure-worker.jsView on unpkg · L14

32 } catch {

33 }

34 return {};

Lines 1062-1102javascript

1062 getControlPlaneUrl,

1063 readConfig,

1064 sanitizeClaudeClientHeaders,

1065 startProcessProxy,

1066 writeConfig,

1067 ORIGINAL_CLAUDE_USER_AGENT_HEADER,

1068 LOCAL_PING_PATH,

1069 LOCAL_PING_HEADER,

1070 LOCAL_PING_HEADER_VALUE,

1071 _private: {

1072 fetchFreshLease

Lines 1134-1174javascript

1134 function checkKnownPathsSync(cmd) {

1135 for (const p of getWindowsKnownPaths(cmd)) {

1136 try {

1137 if (fs.existsSync(p)) {

1138 appendDirToProcessPath(path.dirname(p));

1139 return p;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/configure-worker.jsView on unpkg · L3325

dist/index.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2"use strict";

3var __defProp = Object.defineProperty;

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __name = (target, value) => __defProp(target, "name", { value, configurable: true });

6var

dist/pty-hermes-wrapper.pyView file

•path = dist/pty-hermes-wrapper.py kind = build_helper sizeBytes = 6726 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/pty-hermes-wrapper.pyView on unpkg