registry / @volcengine/ark-cli / 1.0.36

@volcengine/ark-cli@1.0.36

⚠ Under review

火山方舟 ARK 平台命令行工具

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 95.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 14.8 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 1-34json

2 "name": "@volcengine/ark-cli",

3 "version": "1.0.36",

4 "description": "火山方舟 ARK 平台命令行工具",

5 "bin": {

6 "arkcli": "scripts/run.js"

7 },

8 "files": [

9 "scripts/run.js",

10 "scripts/postinstall.js",

11 "manifest.json"

12 ],

13 "scripts": {

14 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "engines": {

17 "node": ">=16"

18 },

19 "os": [

20 "darwin",

21 "linux",

22 "win32"

23 ],

24 "cpu": [

25 "x64",

26 "arm64"

27 ],

28 "license": "Apache-2.0",

29 "repository": {

30 "type": "git",

31 "url": "git+https://github.com/volcengine/ark-cli.git"

32 }

33}

scripts/postinstall.jsView file

•matchType = token_shingles matchedPackage = @volcengine/ark-cli@1.0.29 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHZvbGNlbmdpbmUvYXJrLWNsaQ:1.0.29 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @volcengine/ark-cli@1.0.31 matchedIdentity = npm:QHZvbGNlbmdpbmUvYXJrLWNsaQ:1.0.31 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

@volcengine/ark-cli@1.0.36

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code