registry / blueai-cli / 0.4.4

blueai-cli@0.4.4

⚠ Under review

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 319 KB of source, external domains: bmc-aigc-hb-1306172567.cos.ap-beijing.myqcloud.com, bmc-model-openapi.bluemediagroup.cn

Source & flagged code

3 flagged

dist/lib/validation.jsView file

27contains invisible/control Unicode U+202A (left-to-right embedding) const CONTROL_CHAR_RE = /[---<U+200B><U+200E><U+200F><U+202A>-<U+202E><U+2066>-<U+2069>]/;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/lib/validation.jsView on unpkg · L27

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/cli.js -> dist/lib/command-builder.js -> dist/lib/validation.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/lib/validation.jsView on unpkg

bin/dev.cmdView file

•path = bin/dev.cmd kind = build_helper sizeBytes = 86 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/dev.cmdView on unpkg

Source & flagged code

3 flagged · loading source

dist/lib/validation.jsView file

27contains invisible/control Unicode U+202A (left-to-right embedding) const CONTROL_CHAR_RE = /[---<U+200B><U+200E><U+200F><U+202A>-<U+202E><U+2066>-<U+2069>]/;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/lib/validation.jsView on unpkg · L27

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/cli.js -> dist/lib/command-builder.js -> dist/lib/validation.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/lib/validation.jsView on unpkg

bin/dev.cmdView file

•path = bin/dev.cmd kind = build_helper sizeBytes = 86 magicHex = [redacted]

Medium

Ships Build Helper

Findings

2 Critical4 Medium5 Low

CriticalTrojan Source Unicodedist/lib/validation.js

CriticalTrigger Reachable Dangerous Capabilitydist/lib/validation.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/dev.cmd

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to blueai-cli@0.4.4.

See version security history for other recorded verdicts.

Review the evidence and your use of blueai-cli@0.4.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-13 12:21:12.080Z (UTC).