registry / Remote code execution / @tiens.nguyen/gu-cli / 1.0.686

@tiens.nguyen/gu-cli@1.0.686

Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No install-time malicious behavior was found, but the explicit setup flow is an unauthenticated remote code delivery and execution path. This is a material dangerous capability rather than proof of malicious intent.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the Client Expert setup path in the CLI.

Impact

A compromised package bucket or manifest can cause execution of attacker-controlled code during setup.

Mechanism

Remote archive download, extraction, dependency installation, and local API launch.

AI rationale

Evidence

client-expert-run.mjsclient-expert-api.mjs~/.gonext/api/<version>/

Network endpoints1

gu-api-packages.s3.ap-southeast-1.amazonaws.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The Client Expert setup fetches a mutable remote manifest and package URL.
It verifies the archive only against the hash supplied by that same remote manifest, then extracts it locally.
Setup installs dependencies from the downloaded archive and starts its API.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
The remote setup path is reached from an explicit CLI setup flow, not package installation.
The package blocks cloud metadata endpoints when users configure coding providers.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 1.31 MB of source, external domains: 127.0.0.1, api.moonshot.ai, api.openai.com, chat-api-v2.gomarsic.cc, deb.nodesource.com, docker.com, gu-api-packages.s3.ap-southeast-1.amazonaws.com, hwohu56e8d.execute-api.ap-southeast-1.amazonaws.com, model.invalid, ollama1.gomarsic.cc, pgp.mongodb.com, registry.npmjs.org, repo.mongodb.org, your-ollama.example.com

Source & flagged code

8 flagged

proxy-selftest.mjsView file

Lines 175-215javascript

175 proxyFx.seen.length = 0;

176 const off = { ...proxy, enabled: false };

177 if (shouldProxy(`${MODEL_URL}/chat/completions`, { proxy: off, settings })) {

178 throw new Error("a disabled proxy was still selected for a model call");

179 }

180 // And the call genuinely goes out on its own — which is why it must FAIL to resolve.

181 let wentDirect = false;

182 try {

183 await proxyFetch(`${MODEL_URL}/chat/completions`, {}, { proxy: off, settings });

184 } catch {

185 wentDirect = true;

186 }

187 if (!wentDirect || proxyFx.seen.length > 0) {

188 throw new Error("a disabled proxy still carried the request");

189 }

190 return "off means off";

191 });

192

193 await step("bad credentials are reported as an auth failure", async () => {

194 // So a wrong password reads as "retype it", not as the model being down.

195 const bad = { ...proxy, password: "definitely-wrong" };

Medium

Secret Pattern

Package contains a possible secret pattern.

proxy-selftest.mjsView on unpkg · L195

196 let status = 0;

197 try {

198 status = (await proxyFetch(`${MODEL_URL}/chat/completions`, {}, { proxy: bad, settings })).status;

199 } catch (e) {

200 if (String(e.message).includes("definitely-wrong")) {

201 throw new Error("the password leaked into the error message");

202 }

203 status = 407;

204 }

205 const kind = classifyProxyFailure({ status });

206 if (kind !== "proxy-auth") throw new Error(`a wrong password was classified as "${kind}"`);

207 return "407 is recognised as a credentials problem";

208 });

209

210 await step("the password never appears in output", async () => {

211 // The failure with no error message. Checked against the real dial string, which is the

212 // one place the secret genuinely lives.

213 const dialled = proxyUrl(proxy);

214 if (!dialled.includes(PASS)) throw new Error("the self-test is not exercising a password");

215 const shown = redactSecrets(`connect failed via ${dialled}`);

gu-cli.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * GoNext local worker:

4 * - `gu-cli set <workerKey> [--api-base URL]`

5 * writes ~/.gonext/worker.env

6 * - `gu-cli ws-ping-test` — POST worker ws-ping (needs GONEXT_* env)

7 * - `gu-cli simulate-chat [text]` — claim next chat job, push fake reply like the real worker (needs GONEXT_* env)

8 * - `gu-cli embed --model <mlx-embed-model> [--port 8085]` — run the MLX embeddings server (RAG); use a separate terminal

9 * - `gu-cli workspace add|remove|list …` — manage local code folders the agent may read/edit/test in

10 * - `gu-cli` — starts polling loop (claims jobs and runs models)

platform-tools.mjsView file

Lines 16-56javascript

16 */

17import { execFile } from "node:child_process";

19const IS_WINDOWS = process.platform === "win32";

21const run

coding-provider-setup.mjsView file

Lines 1-32javascript

1/**

2 * Adding an OpenAI-compatible coding provider from the terminal (task #223).

3 *

4 * node --test tests/coding-provider-setup.test.mjs

5 *

6 * The DECISIONS live here and the presentation lives in gu-repl.mjs, the same split

7 * ollama-setup.mjs / reconfigureOllamaServer uses — so what a URL means and what a model list is

8 * worth can be tested without a terminal, and first-run setup and /model cannot disagree.

9 *

10 * WHY THE URL RULES ARE NOT ollama-setup's. normalizeOllamaUrl DISCARDS the path, and it is right

proxy-dispatcher.mjsView file

Lines 21-61javascript

21 * Not an optimisation — a new agent per request opens a new connection pool per request, and a

22 * proxy that authenticates then re-authenticates on every single call, which is both slow and a

23 * good way to trip an account lockout policy. Keyed by the dial string so changing the password

24 * produces a new agent rather than silently reusing the old credentials.

gonext_transcribe.pyView file

•path = gonext_transcribe.py kind = build_helper sizeBytes = 4252 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gonext_transcribe.pyView on unpkg

client-expert-run.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

client-expert-run.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

proxy-selftest.mjsView file

195patternName = generic_password severity = medium line = 195

Medium

Secret Pattern

Package contains a possible secret pattern.

proxy-selftest.mjsView on unpkg · L195

gu-cli.mjsView file

16import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises"; L17: import { execFile as execFileCallback, spawn } from "node:child_process"; L18: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

gu-cli.mjsView on unpkg · L16

1719" Usage: gu-cli embed --model ~/mlx-models/Qwen3-Embedding-8B-4bit-DWQ [--port 8085] [--host 127.0.0.1]\n" + L1720: " (or set GONEXT_EMBED_MODEL). Then set the RAG embedding server URL to http://<host>:<port> in web Settings." L1721: ); ... L1728: const python = L1729: (process.env.GONEXT_PROBE_PYTHON ?? process.env.GONEXT_MLX_LM_PYTHON ?? "").trim() || L1730: "python3"; ... L1734: ); L1735: const child = spawn( L1736: python,

Findings

6 High5 Medium4 Low

HighChild Processgu-cli.mjs

HighShellplatform-tools.mjs

HighSame File Env Network Executiongu-cli.mjs

HighCloud Metadata Accesscoding-provider-setup.mjs

HighCopied Package Dependency Bridgeproxy-dispatcher.mjs

HighSemantic Analysis Limitedclient-expert-run.mjs#virtual:normalized:round1

MediumSecret Patternproxy-selftest.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpergonext_transcribe.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @tiens.nguyen/gu-cli@1.0.686.

See all versions of @tiens.nguyen/gu-cli for other recorded verdicts.

Review the evidence and your use of @tiens.nguyen/gu-cli@1.0.686 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 10:02:50.226Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.