registry / Remote code execution / @tiens.nguyen/gu-cli / 1.0.692

@tiens.nguyen/gu-cli@1.0.692

Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a concrete remote code execution capability behind explicit user interaction, not proof of malicious automatic install behavior. It warrants a warning because the downloader's integrity check is controlled by the same mutable remote manifest as the payload location.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user selects Client Expert in the interactive gu terminal or runs its API upgrade workflow.

Impact

Remote code execution in the invoking user's account.

Mechanism

Remote archive download followed by npm install without a fixed trust root.

AI rationale

Evidence

client-expert-run.mjsclient-expert-api.mjsgu-repl.mjs~/.gonext/api/<manifest.version>

Network endpoints1

gu-api-packages.s3.ap-southeast-1.amazonaws.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The Client Expert flow fetches a mutable remote manifest and follows redirects.
The manifest supplies both the download URL and checksum, so the checksum is not anchored to a bundled trusted value.
The package unpacks the downloaded archive under the user profile and runs npm install there without disabling lifecycle scripts.
This path is reached after an interactive Client Expert choice, not during npm installation.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The remote installer is gated behind an explicit interactive Client Expert selection.
No source evidence shows credential harvesting, stealth persistence, or destructive behavior.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

9 flagged

proxy-selftest.mjsView file

Lines 175-215javascript

175 proxyFx.seen.length = 0;

176 const off = { ...proxy, enabled: false };

177 if (shouldProxy(`${MODEL_URL}/chat/completions`, { proxy: off, settings })) {

178 throw new Error("a disabled proxy was still selected for a model call");

179 }

180 // And the call genuinely goes out on its own — which is why it must FAIL to resolve.

181 let wentDirect = false;

182 try {

183 await proxyFetch(`${MODEL_URL}/chat/completions`, {}, { proxy: off, settings });

184 } catch {

185 wentDirect = true;

186 }

187 if (!wentDirect || proxyFx.seen.length > 0) {

188 throw new Error("a disabled proxy still carried the request");

189 }

190 return "off means off";

191 });

192

193 await step("bad credentials are reported as an auth failure", async () => {

194 // So a wrong password reads as "retype it", not as the model being down.

195 const bad = { ...proxy, password: "definitely-wrong" };

Medium

Secret Pattern

Package contains a possible secret pattern.

proxy-selftest.mjsView on unpkg · L195

196 let status = 0;

197 try {

198 status = (await proxyFetch(`${MODEL_URL}/chat/completions`, {}, { proxy: bad, settings })).status;

199 } catch (e) {

200 if (String(e.message).includes("definitely-wrong")) {

201 throw new Error("the password leaked into the error message");

202 }

203 status = 407;

204 }

205 const kind = classifyProxyFailure({ status });

206 if (kind !== "proxy-auth") throw new Error(`a wrong password was classified as "${kind}"`);

207 return "407 is recognised as a credentials problem";

208 });

209

210 await step("the password never appears in output", async () => {

211 // The failure with no error message. Checked against the real dial string, which is the

212 // one place the secret genuinely lives.

213 const dialled = proxyUrl(proxy);

214 if (!dialled.includes(PASS)) throw new Error("the self-test is not exercising a password");

215 const shown = redactSecrets(`connect failed via ${dialled}`);

gu-cli.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * GoNext local worker:

4 * - `gu-cli set <workerKey> [--api-base URL]`

5 * writes ~/.gonext/worker.env

6 * - `gu-cli ws-ping-test` — POST worker ws-ping (needs GONEXT_* env)

7 * - `gu-cli simulate-chat [text]` — claim next chat job, push fake reply like the real worker (needs GONEXT_* env)

8 * - `gu-cli embed --model <mlx-embed-model> [--port 8085]` — run the MLX embeddings server (RAG); use a separate terminal

9 * - `gu-cli workspace add|remove|list …` — manage local code folders the agent may read/edit/test in

10 * - `gu-cli` — starts polling loop (claims jobs and runs models)

coding-provider-setup.mjsView file

Lines 1-32javascript

1/**

2 * Adding an OpenAI-compatible coding provider from the terminal (task #223).

3 *

4 * node --test tests/coding-provider-setup.test.mjs

5 *

6 * The DECISIONS live here and the presentation lives in gu-repl.mjs, the same split

7 * ollama-setup.mjs / reconfigureOllamaServer uses — so what a URL means and what a model list is

8 * worth can be tested without a terminal, and first-run setup and /model cannot disagree.

9 *

10 * WHY THE URL RULES ARE NOT ollama-setup's. normalizeOllamaUrl DISCARDS the path, and it is right

proxy-dispatcher.mjsView file

Lines 21-61javascript

21 * Not an optimisation — a new agent per request opens a new connection pool per request, and a

22 * proxy that authenticates then re-authenticates on every single call, which is both slow and a

23 * good way to trip an account lockout policy. Keyed by the dial string so changing the password

24 * produces a new agent rather than silently reusing the old credentials.

gonext_transcribe.pyView file

•path = gonext_transcribe.py kind = build_helper sizeBytes = 4252 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gonext_transcribe.pyView on unpkg

client-expert-run.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

client-expert-run.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

proxy-selftest.mjsView file

195patternName = generic_password severity = medium line = 195

Medium

Secret Pattern

Package contains a possible secret pattern.

proxy-selftest.mjsView on unpkg · L195

gu-cli.mjsView file

16import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises"; L17: import { execFile as execFileCallback, spawn } from "node:child_process"; L18: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

gu-cli.mjsView on unpkg · L16

94gu-cli clear [--scratch|--keep-history] [--yes] # back to a fresh machine (asks first) L95: gu-cli fix-powershell [--check] # Windows: drop PowerShell's built-in \`gu\` alias L96: # (it is Get-Unique and shadows this CLI)

High

Shell

Package source references shell execution.

gu-cli.mjsView on unpkg · L94

Findings

7 High5 Medium4 Low

HighChild Processgu-cli.mjs

HighShellgu-cli.mjs

HighSame File Env Network Executiongu-cli.mjs

HighCloud Metadata Accesscoding-provider-setup.mjs

HighCopied Package Dependency Bridgeproxy-dispatcher.mjs

HighSemantic Analysis Limitedclient-expert-run.mjs#virtual:normalized:round1

HighPrevious Version Dangerous Deltagu-cli.mjs

MediumSecret Patternproxy-selftest.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpergonext_transcribe.py

MediumStructural Risk Force Deep Review

LowScripts Present

Low

Affected versions and remediation

This report applies to @tiens.nguyen/gu-cli@1.0.692.

See all versions of @tiens.nguyen/gu-cli for other recorded verdicts.

Review the evidence and your use of @tiens.nguyen/gu-cli@1.0.692 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 12:53:16.697Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.