registry / Credential exfiltration / @taichuai/taichu-cli / 1.0.2

@taichuai/taichu-cli@1.0.2

TaiChu CLI - Manage TaiChu models, usage, and configuration from your terminal

AI Security Review

scanned 28d ago · by lpm-firewall-ai

The fixed private-network default combined with bearer-token forwarding is a real unresolved credential exposure risk, so warn rather than block. The command execution finding is consistent with local machine fingerprinting, and the inspected source does not prove exfiltration of that output.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes a CLI operation that makes a required-auth request while credentials are available.

Impact

A recipient controlling or observing that endpoint could receive the user's service token.

Mechanism

The request client attaches the stored access token as a bearer credential and sends the request to its URL; the default API and auth endpoints use 172.16.10.55.

AI rationale

Evidence

dist/bin/taichu.js

Network endpoints2

172.16.10.55:15497/taichu-web/172.16.10.55:8000

Decision evidence

public snapshot

AI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The shipped `taichu` executable is `dist/bin/taichu.js`.
The CLI defaults both API and authentication endpoints to `172.16.10.55`.
Required-auth requests attach the stored access token as a bearer credential.

Evidence against

The endpoint is configured as the CLI's API and auth service; the inspected source does not establish that it is an unrelated recipient.
Command output is used in local machine fingerprinting; no exfiltration of that output was established.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 312 KB of source, external domains: 127.0.0.1, 172.16.10.55, alioth.alicdn.com, gitee.com, meoo.com, platform.taichuai.com, qoder.com, tongyi.aliyun.com, wukong.dingtalk.com, www.qianwen.com

Source & flagged code

7 flagged

dist/bin/taichu.jsView file

1#!/usr/bin/env node L2: import e,{dirname as t,join as n,resolve as r}from"path";import"url";import{homedir as o,platform as a,machine as i}from"os";import s,{existsSync as l,readFileSync as u,mkdirSync a...

High

Child Process

Package source references child process execution.

dist/bin/taichu.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/bin/taichu.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/taichu.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/taichu.js: import e,{dirname as t,join as n,resolve as r}from"path";import"url";import{homedir as o,platform as a,machine as i}from"os";import s,{existsSync as l,readFileSync as u,mkdirSync a...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/taichu.jsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/taichu.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/taichu.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/bin/taichu.js L1: #!/usr/bin/env node L2: import e,{dirname as t,join as n,resolve as r}from"path";import"url";import{homedir as o,platform as a,machine as i}from"os";import s,{existsSync as l,readFileSync as u,mkdirSync a...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bin/taichu.jsView on unpkg · L1

Findings

7 High3 Medium5 Low

HighChild Processdist/bin/taichu.js

HighShelldist/bin/taichu.js

HighSame File Env Network Executiondist/bin/taichu.js

HighCredential Redirect Persistencedist/bin/taichu.js

HighCommand Output Exfiltrationdist/bin/taichu.js

HighSandbox Evasion Gated Capabilitydist/bin/taichu.js

HighTrigger Reachable Command Output Exfiltrationdist/bin/taichu.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @taichuai/taichu-cli@1.0.2.

See all versions of @taichuai/taichu-cli for other recorded verdicts.

Review the evidence and your use of @taichuai/taichu-cli@1.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 23:35:43.169Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Credential exfiltration / @taichuai/taichu-cli / 1.0.2

@taichuai/taichu-cli@1.0.2

TaiChu CLI - Manage TaiChu models, usage, and configuration from your terminal

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes a CLI operation that makes a required-auth request while credentials are available.

Impact

A recipient controlling or observing that endpoint could receive the user's service token.

Mechanism

The request client attaches the stored access token as a bearer credential and sends the request to its URL; the default API and auth endpoints use 172.16.10.55.

AI rationale

Evidence

dist/bin/taichu.js

Network endpoints2

172.16.10.55:15497/taichu-web/172.16.10.55:8000

Decision evidence

public snapshot

AI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The shipped `taichu` executable is `dist/bin/taichu.js`.
The CLI defaults both API and authentication endpoints to `172.16.10.55`.
Required-auth requests attach the stored access token as a bearer credential.

Evidence against

The endpoint is configured as the CLI's API and auth service; the inspected source does not establish that it is an unrelated recipient.
Command output is used in local machine fingerprinting; no exfiltration of that output was established.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivialUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

dist/bin/taichu.jsView file

High

Child Process

Package source references child process execution.

dist/bin/taichu.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/bin/taichu.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/taichu.jsView on unpkg · L1

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/taichu.jsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/taichu.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/taichu.jsView on unpkg · L1

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bin/taichu.jsView on unpkg · L1

Findings

7 High3 Medium5 Low

HighChild Processdist/bin/taichu.js

HighShelldist/bin/taichu.js

HighSame File Env Network Executiondist/bin/taichu.js

HighCredential Redirect Persistencedist/bin/taichu.js

HighCommand Output Exfiltrationdist/bin/taichu.js

HighSandbox Evasion Gated Capabilitydist/bin/taichu.js

HighTrigger Reachable Command Output Exfiltrationdist/bin/taichu.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @taichuai/taichu-cli@1.0.2.

See all versions of @taichuai/taichu-cli for other recorded verdicts.

Review the evidence and your use of @taichuai/taichu-cli@1.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 23:35:43.169Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.