registry  /  bailian-cli-runtime  /  1.5.0

bailian-cli-runtime@1.5.0

Runtime framework for bailian-cli (createCli, registry, args, output, pipeline). See https://www.npmjs.com/package/bailian-cli for usage.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 213 KB of source, external domains: 127.0.0.1, bailian.console.aliyun.com, help.aliyun.com, json-schema.org, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

3 flagged · loading source
dist/index.mjsView file
38${Re()}\nRun: ${P} auth status — to check credentials.`,{cause:e}),P);if(e instanceof TypeError&&e.message===`fetch failed`)return I(He(e),P);let t=e.code;if(typeof t==`string`&&t.... L39: `),process.stderr.write(` ${a}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c}\n`),d?process.stderr.write(` ${a}⚡ Major update detected: ${e} → ${t}${c}\n`):process.stderr.writ... L40: `),process.stderr.write(` 1. Get your API Key: ${Ie}\n`),process.stderr.write(` 2. Login: ${e} auth login --api-key <your-key>\n\n`)}function yt(){let{dim:e,reset:t}...
High
Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L38
31${i(`and usage examples. For example:`)} ${this.cliName} ${this.helpExample()} --help L32: `)}printCommandHelp(e,t,n){let r=e=>this.bold(e,n),i=e=>this.accent(e,n),a=e=>this.dim(e,n),o=[this.cliName,...t].join(` `);if(n.write(`\n${e.description}\n`),n.write(`${r(`Usage:`... L33: `).map((e,t)=>t===0?e:` `.repeat(13)+e).join(` ... L38: ${Re()}\nRun: ${P} auth status — to check credentials.`,{cause:e}),P);if(e instanceof TypeError&&e.message===`fetch failed`)return I(He(e),P);let t=e.code;if(typeof t==`string`&&t.... L39: `),process.stderr.write(` ${a}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c}\n`),d?process.stderr.write(` ${a}⚡ Major update detected: ${e} → ${t}${c}\n`):process.stderr.writ... L40: `),process.stderr.write(` 1. Get your API Key: ${Ie}\n`),process.stderr.write(` 2. Login: ${e} auth login --api-key <your-key>\n\n`)}function yt(){let{dim:e,reset:t}...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L31
31${i(`and usage examples. For example:`)} ${this.cliName} ${this.helpExample()} --help L32: `)}printCommandHelp(e,t,n){let r=e=>this.bold(e,n),i=e=>this.accent(e,n),a=e=>this.dim(e,n),o=[this.cliName,...t].join(` `);if(n.write(`\n${e.description}\n`),n.write(`${r(`Usage:`... L33: `).map((e,t)=>t===0?e:` `.repeat(13)+e).join(` ... L38: ${Re()}\nRun: ${P} auth status — to check credentials.`,{cause:e}),P);if(e instanceof TypeError&&e.message===`fetch failed`)return I(He(e),P);let t=e.code;if(typeof t==`string`&&t.... L39: `),process.stderr.write(` ${a}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${c}\n`),d?process.stderr.write(` ${a}⚡ Major update detected: ${e} → ${t}${c}\n`):process.stderr.writ... L40: `),process.stderr.write(` 1. Get your API Key: ${Ie}\n`),process.stderr.write(` 2. Login: ${e} auth login --api-key <your-key>\n\n`)}function yt(){let{dim:e,reset:t}...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L31

Findings

3 High3 Medium4 Low
HighChild Processdist/index.mjs
HighSame File Env Network Executiondist/index.mjs
HighCommand Output Exfiltrationdist/index.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings