@taobao-minigame/cli@0.0.5
淘宝开放 CI、CD命令行工具
AI Security Review
scanned 2d ago · by lpm-firewall-aiStartup telemetry sends the configured Taobao nickname to an analytics endpoint without documented disclosure or an apparent opt-out. The remaining observed fields are routine CLI metadata, and I found no credential exfiltration or other concrete attack behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI starts; lib/index.js invokes the launch event during initialization.
Impact
The account nickname can identify the user to the analytics recipient. The other observed launch fields are ordinary runtime and command metadata.
Mechanism
The analytics helper encodes launch fields into a query string and sends them to gm.mmstat.com.
AI rationale
Startup telemetry sends the configured Taobao nickname to an analytics endpoint without documented disclosure or an apparent opt-out. The remaining observed fields are routine CLI metadata, and I found no credential exfiltration or other concrete attack behavior.
Evidence
lib/index.jslib/utils/apis/index.js
Network endpoints1
gm.mmstat.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI entry point sends a launch analytics event during startup.
- The launch event includes the configured Taobao nickname alongside package version, channel, runtime, platform, architecture, and command.
- The analytics event is sent to gm.mmstat.com as query parameters; the README search found no mention of analytics.
Evidence against
- The package is a Taobao CI/CD CLI, and its Taobao login and project upload functions fit that purpose.
- The startup event does not include the token or file contents; it otherwise reports ordinary runtime and command fields.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggedlib/utils/projects/minigame/openDevtools.jsView file
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.openDevtoolsInBrowser=void 0;const child_process_1=require("child_process"),common_1=require("../../comm...
High
Child Process
Package source references child process execution.
lib/utils/projects/minigame/openDevtools.jsView on unpkg · L1lib/commander/upload/miniapp_upload.jsView file
1"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.miniapp_upload=void 0;const{minidev:minidev}=eval("require('minidev')"),core_1=require("../../core"),sta...
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/commander/upload/miniapp_upload.jsView on unpkg · L1lib/core/requst.js
Findings
1 Critical4 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltalib/utils/common.js
HighChild Processlib/utils/projects/minigame/openDevtools.js
HighSandbox Evasion Gated Capabilitylib/utils/common.js
HighRuntime Package Installlib/utils/projects/miniapp/MiniApp.js
HighSemantic Analysis Limitedpackage.json
MediumDynamic Requirelib/core/requst.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobresources/client.tar
MediumStructural Risk Force Deep Review
LowEvallib/commander/upload/miniapp_upload.js
LowWeak Cryptolib/utils/common.js
Low
Affected versions and remediation
This report applies to @taobao-minigame/cli@0.0.5.
See all versions of @taobao-minigame/cli for other recorded verdicts.
- Review the evidence and your use of @taobao-minigame/cli@0.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.