registry / cicy-desktop / 2.1.305

cicy-desktop@2.1.305

⚠ Under review

CiCy - AI-powered operating system browser

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 35 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 145 file(s), 1.76 MB of source, external domains: 127.0.0.1, api.ipapi.is, api.ipify.org, api.myip.com, cdn.npmmirror.com, chatgpt.com, cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com, cicy-1372193042.cos.ap-shanghai.myqcloud.com, cicy-ai.com, desktop.docker.com, example.com, g-electron.cicy.de5.net, gateway.cicy-ai.com, gemini.google.com, ghproxy.net, github.com, ip-api.com, ipinfo.io, mirrors.tuna.tsinghua.edu.cn, mirrors.ustc.edu.cn, nodejs.org, raw.githubusercontent.com, react.dev, registry.npmjs.org, registry.npmmirror.com, schemas.microsoft.com, web.telegram.org, wslstorestorage.blob.core.windows.net, www.apple.com, www.baidu.com, www.docker.com, www.douyin.com, www.google.com, www.gstatic.com, www.w3.org

Source & flagged code

27 flagged

scripts/sync-runtime-deps.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// SPDX-License-Identifier: Apache-2.0

5// Sync optionalDependencies to the LATEST published per-platform cicy-code and

6// cicy-mihomo subpackages, so every cicy-desktop build/publish bundles the

7// newest binaries. Run in CI before install/build (and before `npm publish`).

8//

9// (2026-06-08): Windows no longer ships msys2/tmux — the win sidecar

10// runs the single headless 团队助手 (--helper), so cicy-msys2-* is DROPPED here.

11//

12// Usage: node scripts/sync-runtime-deps.cjs (writes package.json in place)

14const { execSync } = require("child_process");

15const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

16const path = require("path");

18const REGISTRY = process.env.NPM_REGISTRY || "https://registry.npmjs.org";

19const PLATFORMS = ["darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64", "windows-x64", "windows-arm64"];

20const COMPONENTS = ["cicy-code", "cicy-mihomo"]; // NOT cicy-msys2 — win drops it

22function latest(pkg) {

23 // Use execSync (runs through a shell) instead of execFileSync: on Windows npm

24 // is npm.cmd, and Node refuses to spawn .cmd/.bat without a shell (EINVAL) —

25 // execFileSync('npm'|'npm.cmd', …) therefore threw on every call and the whole

26 // script aborted with "resolved nothing" even though the registry was fine.

27 // cmd.exe (win) / sh (unix) resolve `npm` correctly. pkg/REGISTRY are trusted

28 // constants, so the interpolation is safe.

29 try {

30 return execSync(`npm view ${pkg} version --registry=${REGISTRY}`, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;

31 } catch {

32 return null; // not published for this platform (e.g. cicy-code has no windows-arm64)

33 }

bin/cicy-desktopView file

Lines 146-186text

146 try { fs.mkdirSync(dlDir, { recursive: true }); } catch {}

147 const dest = path.join(dlDir, zip);

148 const expected = remoteContentLength(curl, url);

149 let localSz = 0; try { localSz = fs.statSync(dest).size; } catch {}

150 const complete = localSz >= 50 * 1024 * 1024 && (!expected || localSz === expected);

151 if (complete) {

152 console.log(`[ok] 复用已下载的 Electron:${dest}`);

153 } else {

154 const resuming = localSz > 0;

155 console.log(` 下载 Electron ${ELECTRON_VERSION}(来源:${src}${resuming ? ",断点续传" : ""})→ ${dest}`);

156 // -C - 断点续传(部分则 206 续,缺则 200 全下);-# 进度条;inherit 让进度条画到终端。

157

src/tools/file-tools.jsView file

Lines 1-28javascript

2// SPDX-License-Identifier: Apache-2.0

4const { z } = require("zod");

5const fs = require("fs");

src/sidecar/docker.jsView file

Lines 1-30javascript

2// SPDX-License-Identifier: Apache-2.0

4// Windows sidecar backend: run cicy-code inside a Docker container.

5//

6// Platform split (2026-06): mac/linux start cicy-code locally via `npx

7// cicy-code` (see cicy-code.js); Windows runs it in Docker Desktop instead.

8// The base-env image's entrypoint installs cicy-code from npm at container

9// startup, so the image is version-independent. If the image isn't present

10// locally it's loaded from R2 (CN-friendly, no Docker Hub pull):

src/sidecar/host-mihomo.jsView file

Lines 1-40javascript

2// SPDX-License-Identifier: Apache-2.0

4// Host-side mihomo for the Chrome per-profile proxy.

5//

6// docker-only put mihomo INSIDE the cicy-code container. But the system Chrome

7// runs on the HOST (mac/win/linux), and its per-profile proxy points at

8// 127.0.0.1:2000N — which a container CANNOT reliably serve through colima/WSL

9// port-forwarding (the per-profile listeners bind 127.0.0.1 inside the container;

10// publishing the 20001-32 range through colima/Lima never reached them → Chrome

bin/cicy-desktop#virtual:normalized:round1View file

494// A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L495: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L496: // ... L500: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L501: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L502: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

494Trigger-reachable command-output exfiltration chain: scripts.start -> bin/cicy-desktop L494: // A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L495: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L496: // ... L500: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L501: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L502: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

src/sidecar/colima-docker.jsView file

Lines 6-46javascript

6// macOS 没有 WSL。对应 Windows 端「不装 Docker Desktop GUI、用确定性命令驱动

7// Docker 引擎」的方案,在 Mac 上就是 Colima:一个 Apache-2.0、纯 CLI、无 GUI、

8// 无授权、无 root 的轻量 Linux VM(基于 Lima),里面跑标准 Docker 引擎。Lima 会

9// 把 VM 内监听 127.0.0.1 的端口自动转发到宿主 127.0.0.1,所以 VM 里发布在

10// :8008 的容器,Mac 上 127.0.0.1:8008 直接可达——和 WSL2 的 localhost 转发等价。

11//

12// 与 wsl-docker.js 完全同接口(bootstrap/status/restart/stop/dockerRestart/

13// recreate/update/upgrade/runContainer/readContainerToken),由 sidecar-ipc.js

14// 按平台分发:darwin → 本模块,win32 → wsl-docker.js。

15//

src/tools/system-tools.jsView file

4const { z } = require("zod"); L5: const { execSync } = require("child_process"); L6: ... L19: L20: if (process.platform === "linux") { L21: // 使用 wmctrl 获取窗口信息 ... L58: const baseUrl = L59: process.env.CICY_BASE_URL || `http://localhost:${process.env.PORT || 8101}`; L60: const thumbUrl = `${baseUrl}/files/screenshot/sys_win_${winId.replace(/^0x/, "")}.jpeg`; ... L107: const screenshotDir = path.join( L108: require("os").homedir(), L109: "cicy-files",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/system-tools.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/tools/system-tools.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/system-tools.jsView on unpkg

src/sidecar/wsl-docker.jsView file

16Trigger-reachable chain: manifest.main -> src/main.js -> src/backends/local-teams.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L28: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L29: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L30: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L39: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L40: "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/rootfs/cicy-wsl-latest.tar.gz"; L41: ... L63: } catch (e) { L64: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L65: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

16Trigger-reachable persistence chain: manifest.main -> src/main.js -> src/backends/local-teams.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L28: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L29: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L30: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L39: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L40: "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/rootfs/cicy-wsl-latest.tar.gz"; L41: ... L63: } catch (e) { L64: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L65: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.js

scripts/build-homepage.cjsView file

27console.log(`[build-homepage] $ ${cmd} (in ${path.relative(ROOT, cwd) || "."})`); L28: execSync(cmd, { cwd, stdio: "inherit" }); L29: } ... L32: if (!fs.existsSync(path.join(RENDER, "node_modules"))) { L33: run("npm install --no-audit --no-fund", RENDER); L34: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 846 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/backends/local-teams.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/backends/local-teams.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/local-teams.jsView on unpkg

src/backends/window-manager.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/backends/window-manager.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/window-manager.jsView on unpkg

src/cloud/cloud-client.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/cloud/cloud-client.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cloud/cloud-client.jsView on unpkg

src/main-old.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/main-old.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main-old.jsView on unpkg

src/tools/exec-tools.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/tools/exec-tools.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/exec-tools.jsView on unpkg

src/backends/ipc.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/backends/ipc.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/ipc.jsView on unpkg

src/sidecar/localbin.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/sidecar/localbin.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/localbin.jsView on unpkg

src/sidecar/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/sidecar/runtime.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/runtime.jsView on unpkg

src/tabbrowser/redroid-matrix.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/tabbrowser/redroid-matrix.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tabbrowser/redroid-matrix.jsView on unpkg

cicy-desktop@2.1.305

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code