registry / @tiens.nguyen/gu-cli / 1.0.783
@tiens.nguyen/gu-cli@1.0.783
Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection found a postinstall PATH setup hook and application configuration and authentication logic, but no concrete malicious chain. The scanner hints do not establish credential exfiltration or unconsented agent-control mutation.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation invokes the postinstall hook; REPL authentication occurs when the user runs the CLI.
Impact
The inspected behavior does not establish credential theft or unconsented agent-control mutation.
Mechanism
The hook checks that it is running as the direct entrypoint, and the REPL loads its worker key and API base from configuration.
AI rationale
Source inspection found a postinstall PATH setup hook and application configuration and authentication logic, but no concrete malicious chain. The scanner hints do not establish credential exfiltration or unconsented agent-control mutation.
Evidence
install-path.mjsmcp-config.mjsgu-repl.mjs
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest identifies this package as the Gu CLI and points postinstall to install-path.mjs; that hook is guarded to run only as the direct entrypoint.
- The MCP configuration code reads user configuration and validates its JSON structure; the inspected source does not establish unconsented agent-control mutation.
- The inspected Mongo, client setup, CLI, REPL, provider, proxy, and agent-stop excerpts are consistent with package features and do not establish malicious behavior.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-path.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgproxy-selftest.mjsView file
195patternName = generic_password
severity = medium
line = 195
Medium
mongo-native.mjsView file
18*/
L19: import { spawn } from "node:child_process";
L20: import { existsSync } from "node:fs";
High
client-expert-api.mjsView file
198child = shell
L199: ? spawn(line, { cwd: apiDir, stdio: ["ignore", "pipe", "pipe"], shell: true })
L200: : spawn(cmd, args, { cwd: apiDir, stdio: ["ignore", "pipe", "pipe"], shell: false });
High
•matchType = previous_version_dangerous_delta
matchedPackage = @tiens.nguyen/gu-cli@1.0.692
matchedIdentity = npm:QHRpZW5zLm5ndXllbi9ndS1jbGk:1.0.692
similarity = 0.541
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
client-expert-api.mjsView on unpkgrag-selftest.mjs#virtual:normalized:round1View file
34function haystackFile(n) {
L35: const lines = [`// Service module ${n}: request handling for the platform"s internal API.`];\n for (let i = 1; i <= 40; i++) {\n lines.push(\n `// helper ${i}: validates t...
L36: // embedder is down" when it is simply a different path.\n const raw = String(s.ragEmbedUrl || "").replace(//+$/, "");\n embedUrl = raw && !//v1$/i.test(raw) ? `${raw}/v1` : ...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
rag-selftest.mjs#virtual:normalized:round1View on unpkg · L34gu-cli.mjsView file
2113" Usage: gu-cli embed --model ~/mlx-models/Qwen3-Embedding-8B-4bit-DWQ [--port 8085] [--host 127.0.0.1]\n" +
L2114: " (or set GONEXT_EMBED_MODEL). Then set the RAG embedding server URL to http://<host>:<port> in web Settings."
L2115: );
...
L2122: const python =
L2123: (process.env.GONEXT_PROBE_PYTHON ?? process.env.GONEXT_MLX_LM_PYTHON ?? "").trim() ||
L2124: "python3";
...
L2128: );
L2129: const child = spawn(
L2130: python,
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
gu-cli.mjsView on unpkg · L211318import { mkdir, mkdtemp, readFile, rm, stat, unlink, writeFile } from "node:fs/promises";
L19: import { execFile as execFileCallback, spawn } from "node:child_process";
L20: import { createHash, randomUUID } from "node:crypto";
...
L75:
L76: // Running worker version, read from the package's own package.json (single source of
L77: // truth) so the startup banner shows exactly which build a box is running (task #105).
...
L88:
L89: const ENV_FILE = join(homedir(), ".gonext", "worker.env");
L90: const preloadedWorkerKey = String(process.env.GONEXT_WORKER_KEY ?? "").trim();
L91: const envFileLoad = dotenv.config({ path: ENV_FILE });
...
L145: Examples:
L146: gu-cli set abc123 --api-base https://hwohu56e8d.execute-api.ap-southeast-1.amazonaws.com
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
gu-cli.mjsView on unpkg · L18gu-repl.mjsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
gu-repl.mjs:
import { readFile, mkdir, writeFile, unlink, rename } from "node:fs/promises";
import { existsSync, statSync, readFileSync, writeFileSync, readdirSync, openSync, readSync, closeSync, mkdirSync } from "node:fs";
import { createInterface } from "node:readline";
// A SELF-CONTAINED prompt: this runs before the REPL's readline (and its ask()) is
// ONE readline for the whole first run: the mode question and the key prompt share it,
// the REPL's own readline exists, so it owns the terminal here).
const rl0 = (await import("node:readline")).createInterface({
// Exit AFTER the readline is closed, so the terminal is left in a usa
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
gu-repl.mjsView on unpkgcoding-provider-setup.mjsView file
12* a log means the box. An OpenAI-compatible provider is the opposite — the path is part of the
L13: * address. https://openrouter.ai/api/v1 is OpenRouter's documented base, and dropping the /api
L14: * from it 404s every call. So this keeps the path and mirrors the API's normalizeOpenAiV1Root
...
L47: if (a === 169 && b === 254) return "link-local"; // includes 169.254.169.254 (IMDS)
L48: if (a === 10) return "private";
L49: if (a === 172 && b >= 16 && b <= 31) return "private";
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
coding-provider-setup.mjsView on unpkg · L12proxy-dispatcher.mjsView file
41package = @tiens.nguyen/gu-cli; repositoryIdentity = gu; dependency = undici
L41: try {
L42: ({ ProxyAgent: ProxyAgentCtor } = await import("undici"));
L43: } catch (err) {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
proxy-dispatcher.mjsView on unpkg · L41gonext_transcribe.pyView file
•path = gonext_transcribe.py
kind = build_helper
sizeBytes = 4248
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
gonext_transcribe.pyView on unpkgagent-stop.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
agent-stop.mjs#virtual:normalized:round1View on unpkgFindings
10 High6 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processmongo-native.mjs
HighShellclient-expert-api.mjs
HighSame File Env Network Executiongu-cli.mjs
HighCredential Redirect Persistencegu-repl.mjs
HighSandbox Evasion Gated Capabilitygu-cli.mjs
HighCloud Metadata Accesscoding-provider-setup.mjs
HighCopied Package Dependency Bridgeproxy-dispatcher.mjs
HighSemantic Analysis Limitedagent-stop.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltaclient-expert-api.mjs
MediumSecret Patternproxy-selftest.mjs
MediumDynamic Requirerag-selftest.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpergonext_transcribe.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tiens.nguyen/gu-cli@1.0.783.
See all versions of @tiens.nguyen/gu-cli for other recorded verdicts.
- Review the evidence and your use of @tiens.nguyen/gu-cli@1.0.783 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.