registry / Credential exfiltration / @taichuai/taichu-cli
@taichuai/taichu-cli
TaiChu CLI - Manage TaiChu models, usage, and configuration from your terminal
This report shows the evidence for @taichuai/taichu-cli@1.0.7. 1 of 5 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe bundled CLI's release-check code forwards GitHub credentials to a Gitee endpoint, which is a concrete cross-service credential disclosure. The inspected excerpts do not establish the exact command trigger, but the credential handling and destination are explicit.
Static reason
One or more suspicious static signals were detected.
Trigger
When the bundled release-check function runs; its caller was not established from the inspected excerpts.
Impact
A GitHub credential can be disclosed to a different service without user consent.
Mechanism
It reads GITHUB_TOKEN or GH_TOKEN from the environment and attaches the value as a bearer Authorization header to a request for the latest release on Gitee.
Attack narrative
The release-check function obtains GITHUB_TOKEN or GH_TOKEN from the environment and sends it as a bearer credential to the package's Gitee release endpoint. This exposes a credential intended for GitHub to another service. The bundled CLI is the manifest's executable entry point, though the inspected excerpts do not establish which command invokes the checker.
AI rationale
The bundled CLI's release-check code forwards GitHub credentials to a Gitee endpoint, which is a concrete cross-service credential disclosure. The inspected excerpts do not establish the exact command trigger, but the credential handling and destination are explicit.
Evidence
dist/bin/taichu.js
Network endpoints1
gitee.com/api/v5/repos/wair-ac/taichu-cli/releases/latest
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The CLI's release-check function reads GITHUB_TOKEN or GH_TOKEN and puts the value in an Authorization bearer header.
- That request targets https://gitee.com/api/v5/repos/wair-ac/taichu-cli/releases/latest, a Gitee endpoint rather than GitHub's API.
- The manifest exposes dist/bin/taichu.js as the taichu command, making the bundled CLI reachable.
Evidence against
- The package is described as a TaiChu CLI, and the Gitee repository is its declared project repository.
- The manifest's prepare script builds the CLI; the reviewed release-check code does not show install-time network contact.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings
Source & flagged code
7 flaggeddist/bin/taichu.jsView file
1#!/usr/bin/env node
L2: import e,{dirname as t,join as n,resolve as r}from"path";import"url";import{homedir as o,platform as a,machine as i}from"os";import s,{existsSync as l,readFileSync as u,mkdirSync a...
High
1#!/usr/bin/env node
L2: import e,{dirname as t,join as n,resolve as r}from"path";import"url";import{homedir as o,platform as a,machine as i}from"os";import s,{existsSync as l,readFileSync as u,mkdirSync a...
High
1#!/usr/bin/env node
L2: import e,{dirname as t,join as n,resolve as r}from"path";import"url";import{homedir as o,platform as a,machine as i}from"os";import s,{existsSync as l,readFileSync as u,mkdirSync a...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bin/taichu.jsView on unpkg · L1Findings
7 High3 Medium5 Low
HighChild Processdist/bin/taichu.js
HighShelldist/bin/taichu.js
HighSame File Env Network Executiondist/bin/taichu.js
HighCredential Redirect Persistencedist/bin/taichu.js
HighCommand Output Exfiltrationdist/bin/taichu.js
HighSandbox Evasion Gated Capabilitydist/bin/taichu.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/taichu.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @taichuai/taichu-cli@1.0.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing @taichuai/taichu-cli@1.0.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.