registry / cbs-cainiao-merchant-cli / 0.0.5

cbs-cainiao-merchant-cli@0.0.5

Cbs merchant CLI tool

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 33 file(s), 272 KB of source, external domains: cainiao.4px.com, docs.npmjs.com, registry.npmjs.org

Source & flagged code

3 flagged

package.jsonView file

Lines 16-56json

16 "scripts/postinstall.js"

17 ],

18 "scripts": {

19 "build": "node scripts/build.js",

20 "tsc": "tsc",

21 "dev": "tsx src/index.ts",

22 "typecheck": "tsc --noEmit",

23 "test": "node --import tsx --test test/*.test.ts",

24 "build:4px:test": "SITE=4px ENV=test npm run build",

25 "build:4px:pre": "SITE=4px ENV=pre npm run build",

26 "build:cainiao:test": "SITE=cainiao ENV=test npm run build",

27 "build:cainiao:pre": "SITE=cainiao ENV=pre npm run build",

28 "dev:4px:test": "SITE=4px ENV=test npm run build && node dist/index.js skill install",

29 "dev:4px:pre": "SITE=4px ENV=pre npm run build && node dist/index.js skill install",

30 "dev:cainiao:test": "SITE=cainiao ENV=test npm run build && node dist/index.js skill install",

31 "dev:cainiao:pre": "SITE=cainiao ENV=pre npm run build && node dist/index.js skill install",

32 "release": "npm run build && node scripts/publish.js",

33 "release:4px": "SITE=4px ENV=prod npm run release",

34 "release:cainiao": "SITE=cainiao ENV=prod npm run release",

35 "prepublishOnly": "node scripts/guard-publish.js",

36 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L36

37 },

38 "publishConfig": {

39 "access": "public",

40 "registry": "https://registry.npmjs.org"

41 },

42 "dependencies": {

43 "axios": "^1.7.0",

44 "chalk": "^5.3.0",

45 "commander": "^12.0.0",

46 "ora": "^9.4.0"

47 },

48 "devDependencies": {

49 "@types/node": "^20.0.0",

50 "tsx": "^4.0.0",

51 "typescript": "^5.9.3"

52 },

53 "engines": {

54 "node": ">=18.0.0"

55 }

56}

dist/services/update-checker.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.2 matchedPath = dist/services/update-checker.js matchedIdentity = npm:[redacted]:0.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/update-checker.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code