registry / @t2000/cli / 5.20.0

@t2000/cli@5.20.0

Agent Wallet for AI agents on Sui — gasless USDC + USDsui sends, Cetus swap, MPP paid API access, MCP integration, scriptable from any shell.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 4.70 MB of source, external domains: accounts.google.com, api-sui.cetus.zone, api.example.com, api.t2000.ai, api.trustedservices.intel.com, crypto.stackexchange.com, developers.t2000.ai, docs.sui.io, eprint.iacr.org, example.com, fullnode.mainnet.sui.io, fullnode.testnet.sui.io, github.com, graphql.mainnet.sui.io, hermes.pyth.network, hyperelliptic.org, mainnet.mvr.mystenlabs.com, mpp.t2000.ai, nodejs.org, pccs.phala.network, suiscan.xyz, suspicious-site.com, t2000.ai, testnet.mvr.mystenlabs.com, www.w3.org, x402.t2000.ai

Oversized source lightweight scan

dist/dist-OBNLH7CK.js4.05 MB file, sampled 256 KB

FilesystemNetworkEnvironmentVarsCryptoHighEntropyStringsUrlStringsdevelopers.t2000.aidocs.sui.ioexample.comfullnode.mainnet.sui.iofullnode.testnet.sui.iompp.t2000.ainodejs.orgsuiscan.xyzsuspicious-site.comt2000.ai

Source & flagged code

5 flagged

dist/chunk-TP3M7BAU.jsView file

Lines 1301-1341javascript

1301 /**

1302 * Add a new object input to the transaction using the fully-resolved object reference.

1303 * If you only have an object ID, use `builder.object(id)` instead.

1304 */

1305 objectRef(...args) {

1306 return this.object(Inputs.ObjectRef(...args));

1307 }

1308 /**

1309 * Add a new receiving input to the transaction using the fully-resolved object reference.

1310 * If you only have an object ID, use `builder.object(id)` instead.

1311 */

1312 receivingRef(...args) {

1313 return this.object(Inputs.ReceivingRef(...args));

1314 }

1315 /**

1316 * Add a new shared object input to the transaction using the fully-resolved shared object reference.

1317 * If you only have an object ID, use `builder.object(id)` instead.

1318 */

1319 sharedObjectRef(...args) {

1320 return this.object(Inputs.SharedObjectRef(...args));

1321 }

1322 #fork() {

1323 const fork = new Transaction2();

High

Child Process

Package source references child process execution.

dist/chunk-TP3M7BAU.jsView on unpkg · L1321

1324 fork.#data = this.#data;

1325 fork.#serializationPlugins = this.#serializationPlugins;

1326 fork.#buildPlugins = this.#buildPlugins;

1327 fork.#intentResolvers = this.#intentResolvers;

1328 fork.#pendingPromises = this.#pendingPromises;

1329 fork.#availableResults = new Set(this.#availableResults);

1330 fork.#added = this.#added;

1331 this.#inputSection.push(fork.#inputSection);

1332 this.#commandSection.push(fork.#commandSection);

1333 return fork;

1334 }

1335 add(command) {

1336 if (typeof command === "function") {

1337 if (this.#added.has(command)) return this.#added.get(command);

1338 const fork = this.#fork();

1339 const result = command(fork);

1340 if (!(result && typeof result === "object" && "then" in result)) {

1341 this.#availableResults = fork.#availableResults;

dist/index.jsView file

2057} L2058: const execArgv = process5.execArgv ?? []; L2059: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L2057

1Cross-file remote execution chain: dist/index.js spawns dist/chunk-MBNGFMZQ.js; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { createRequire as __createRequire } from 'module'; import { fileURLToPath as __fileURLToPath } from 'url'; import { dirname as __pathDirname } from 'path'; const require = ... L3: import { ... L30: deriveDynamicFieldID, L31: fromBase64 as fromBase642, L32: suiBcs, ... L102: * Constructs the CommanderError class L103: * @param {number} exitCode suggested exit code which could be used with process.exit L104: * @param {string} code an id string representing the error ... L1217: var EventEmitter2 = __require("events").EventEmitter; L1218: var childProcess = __require("child_process"); L1219: var path2 = __require("path");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

dist/src-FIYSHJR4.jsView file

1import { createRequire as __createRequire } from 'module'; import { fileURLToPath as __fileURLToPath } from 'url'; import { dirname as __pathDirname } from 'path'; const require = ... L2: import { ... L92: var PLATFORM_ISSUER_ID = "platform"; L93: var TRUSTED_ROOT_CA_DER_BASE64 = "[redacted]... L94: var TRUSTED_ROOT_CA_DER = Buffer2.from(TRUSTED_ROOT_CA_DER_BASE64, "base64"); ... L279: reserved4: reader.readBytes(60), L280: reportData: reader.readBytes(64) L281: }); ... L4232: 2: "context", L4233: 3: "private" L4234: }; ... L6614: bugs: {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/src-FIYSHJR4.jsView on unpkg · L1

dist/dist-OBNLH7CK.jsView file

•path = dist/dist-OBNLH7CK.js kind = oversized_source_file sizeBytes = 4250206 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-OBNLH7CK.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/chunk-TP3M7BAU.jsView file

1321} L1322: #fork() { L1323: const fork = new Transaction2();

High

Child Process

Package source references child process execution.

dist/chunk-TP3M7BAU.jsView on unpkg · L1321

dist/index.jsView file

2057} L2058: const execArgv = process5.execArgv ?? []; L2059: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L2057

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

dist/src-FIYSHJR4.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/src-FIYSHJR4.jsView on unpkg · L1

dist/dist-OBNLH7CK.jsView file

•path = dist/dist-OBNLH7CK.js kind = oversized_source_file sizeBytes = 4250206 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-OBNLH7CK.jsView on unpkg

Findings

5 High3 Medium5 Low

HighChild Processdist/chunk-TP3M7BAU.js

HighShelldist/index.js

HighCross File Remote Execution Contextdist/index.js

HighBase64 Obscured Urldist/src-FIYSHJR4.js

HighOversized Source Filedist/dist-OBNLH7CK.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/chunk-TP3M7BAU.jsView file

Lines 1301-1341javascript

1301 /**

1302 * Add a new object input to the transaction using the fully-resolved object reference.

1303 * If you only have an object ID, use `builder.object(id)` instead.

1304 */

1305 objectRef(...args) {

1306 return this.object(Inputs.ObjectRef(...args));

1307 }

1308 /**

1309 * Add a new receiving input to the transaction using the fully-resolved object reference.

1310 * If you only have an object ID, use `builder.object(id)` instead.

1311 */

1312 receivingRef(...args) {

1313 return this.object(Inputs.ReceivingRef(...args));

1314 }

1315 /**

1316 * Add a new shared object input to the transaction using the fully-resolved shared object reference.

1317 * If you only have an object ID, use `builder.object(id)` instead.

1318 */

1319 sharedObjectRef(...args) {

1320 return this.object(Inputs.SharedObjectRef(...args));

1321 }

1322 #fork() {

1323 const fork = new Transaction2();

High

Child Process

Package source references child process execution.

dist/chunk-TP3M7BAU.jsView on unpkg · L1321

1324 fork.#data = this.#data;

1325 fork.#serializationPlugins = this.#serializationPlugins;

1326 fork.#buildPlugins = this.#buildPlugins;

1327 fork.#intentResolvers = this.#intentResolvers;

1328 fork.#pendingPromises = this.#pendingPromises;

1329 fork.#availableResults = new Set(this.#availableResults);

1330 fork.#added = this.#added;

1331 this.#inputSection.push(fork.#inputSection);

1332 this.#commandSection.push(fork.#commandSection);

1333 return fork;

1334 }

1335 add(command) {

1336 if (typeof command === "function") {

1337 if (this.#added.has(command)) return this.#added.get(command);

1338 const fork = this.#fork();

1339 const result = command(fork);

1340 if (!(result && typeof result === "object" && "then" in result)) {

1341 this.#availableResults = fork.#availableResults;

dist/index.jsView file

2057} L2058: const execArgv = process5.execArgv ?? []; L2059: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L2057

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

dist/src-FIYSHJR4.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/src-FIYSHJR4.jsView on unpkg · L1

dist/dist-OBNLH7CK.jsView file

•path = dist/dist-OBNLH7CK.js kind = oversized_source_file sizeBytes = 4250206 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dist-OBNLH7CK.jsView on unpkg