registry / cicy-desktop / 2.1.312

cicy-desktop@2.1.312

CiCy - AI-powered operating system browser

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Running the desktop application can create persistent Windows WSL startup state and download executable runtime components. Authenticated tool use can write extension code or grant a container SSH access to the host.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The user runs the CLI or desktop app; privileged tool actions require authenticated or UI-mediated requests.

Impact

A compromised update source or authorized controller could obtain durable code execution or host access.

Mechanism

Remote binary provisioning, persistent service setup, and host-control tools.

AI rationale

The package has substantial persistent remote-code and host-control capability during normal runtime, including unauthenticated artifact integrity gaps. Its risky actions are runtime features rather than automatic npm installation behavior, so the source supports a warning rather than a malware block.

Evidence

bin/cicy-desktopsrc/sidecar/wsl-docker.jssrc/tools/electron-inject-tools.jssrc/sidecar/colima-docker.js~/.local/bin/mihomo~/cicy-ai/db/mihomo-host.yaml%LOCALAPPDATA%/cicy-desktop~/.ssh/authorized_keys

Network endpoints2

cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/electron/github.com/electron/electron/releases/download/

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The runtime creates a hidden Windows logon task that keeps its WSL Docker service alive.
The user-invoked launcher downloads and executes Electron binaries from remote mirrors without source verification.
An authenticated MCP tool can install arbitrary JavaScript into a fixed Electron extension directory.
A Mac action adds a container-controlled SSH public key to the user's authorized_keys file.

Evidence against

package.json has no install, preinstall, or postinstall lifecycle hook.
MCP routes require authentication, and renderer RPCs require origin and dangerous-operation consent.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 145 file(s), 1.76 MB of source, external domains: 127.0.0.1, api.ipapi.is, api.ipify.org, api.myip.com, cdn.npmmirror.com, chatgpt.com, cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com, cicy-1372193042.cos.ap-shanghai.myqcloud.com, cicy-ai.com, desktop.docker.com, example.com, g-electron.cicy.de5.net, gateway.cicy-ai.com, gemini.google.com, ghproxy.net, github.com, ip-api.com, ipinfo.io, mirrors.tuna.tsinghua.edu.cn, mirrors.ustc.edu.cn, nodejs.org, raw.githubusercontent.com, react.dev, registry.npmjs.org, registry.npmmirror.com, schemas.microsoft.com, web.telegram.org, wslstorestorage.blob.core.windows.net, www.apple.com, www.baidu.com, www.docker.com, www.douyin.com, www.google.com, www.gstatic.com, www.w3.org

Source & flagged code

16 flagged

scripts/sync-runtime-deps.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// SPDX-License-Identifier: Apache-2.0

5// Sync optionalDependencies to the LATEST published per-platform cicy-code and

6// cicy-mihomo subpackages, so every cicy-desktop build/publish bundles the

7// newest binaries. Run in CI before install/build (and before `npm publish`).

8//

9// (2026-06-08): Windows no longer ships msys2/tmux — the win sidecar

10// runs the single headless 团队助手 (--helper), so cicy-msys2-* is DROPPED here.

11//

12// Usage: node scripts/sync-runtime-deps.cjs (writes package.json in place)

14const { execSync } = require("child_process");

15const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

16const path = require("path");

18const REGISTRY = process.env.NPM_REGISTRY || "https://registry.npmjs.org";

19const PLATFORMS = ["darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64", "windows-x64", "windows-arm64"];

20const COMPONENTS = ["cicy-code", "cicy-mihomo"]; // NOT cicy-msys2 — win drops it

22function latest(pkg) {

23 // Use execSync (runs through a shell) instead of execFileSync: on Windows npm

24 // is npm.cmd, and Node refuses to spawn .cmd/.bat without a shell (EINVAL) —

25 // execFileSync('npm'|'npm.cmd', …) therefore threw on every call and the whole

26 // script aborted with "resolved nothing" even though the registry was fine.

27 // cmd.exe (win) / sh (unix) resolve `npm` correctly. pkg/REGISTRY are trusted

28 // constants, so the interpolation is safe.

29 try {

30 return execSync(`npm view ${pkg} version --registry=${REGISTRY}`, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;

31 } catch {

32 return null; // not published for this platform (e.g. cicy-code has no windows-arm64)

33 }

bin/cicy-desktopView file

Lines 146-186text

146 try { fs.mkdirSync(dlDir, { recursive: true }); } catch {}

147 const dest = path.join(dlDir, zip);

148 const expected = remoteContentLength(curl, url);

149 let localSz = 0; try { localSz = fs.statSync(dest).size; } catch {}

150 const complete = localSz >= 50 * 1024 * 1024 && (!expected || localSz === expected);

151 if (complete) {

152 console.log(`[ok] 复用已下载的 Electron:${dest}`);

153 } else {

154 const resuming = localSz > 0;

155 console.log(` 下载 Electron ${ELECTRON_VERSION}(来源:${src}${resuming ? ",断点续传" : ""})→ ${dest}`);

156 // -C - 断点续传(部分则 206 续,缺则 200 全下);-# 进度条;inherit 让进度条画到终端。

157

src/tools/file-tools.jsView file

Lines 1-28javascript

2// SPDX-License-Identifier: Apache-2.0

4const { z } = require("zod");

5const fs = require("fs");

src/sidecar/docker.jsView file

Lines 1-30javascript

2// SPDX-License-Identifier: Apache-2.0

4// Windows sidecar backend: run cicy-code inside a Docker container.

5//

6// Platform split (2026-06): mac/linux start cicy-code locally via `npx

7// cicy-code` (see cicy-code.js); Windows runs it in Docker Desktop instead.

8// The base-env image's entrypoint installs cicy-code from npm at container

9// startup, so the image is version-independent. If the image isn't present

10// locally it's loaded from R2 (CN-friendly, no Docker Hub pull):

src/sidecar/host-mihomo.jsView file

Lines 1-40javascript

2// SPDX-License-Identifier: Apache-2.0

4// Host-side mihomo for the Chrome per-profile proxy.

5//

6// docker-only put mihomo INSIDE the cicy-code container. But the system Chrome

7// runs on the HOST (mac/win/linux), and its per-profile proxy points at

8// 127.0.0.1:2000N — which a container CANNOT reliably serve through colima/WSL

9// port-forwarding (the per-profile listeners bind 127.0.0.1 inside the container;

10// publishing the 20001-32 range through colima/Lima never reached them → Chrome

bin/cicy-desktop#virtual:normalized:round1View file

494// A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L495: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L496: // ... L500: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L501: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L502: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

494Trigger-reachable command-output exfiltration chain: scripts.start -> bin/cicy-desktop L494: // A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L495: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L496: // ... L500: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L501: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L502: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

src/sidecar/colima-docker.jsView file

Lines 6-46javascript

6// macOS 没有 WSL。对应 Windows 端「不装 Docker Desktop GUI、用确定性命令驱动

7// Docker 引擎」的方案,在 Mac 上就是 Colima:一个 Apache-2.0、纯 CLI、无 GUI、

8// 无授权、无 root 的轻量 Linux VM(基于 Lima),里面跑标准 Docker 引擎。Lima 会

9// 把 VM 内监听 127.0.0.1 的端口自动转发到宿主 127.0.0.1,所以 VM 里发布在

10// :8008 的容器,Mac 上 127.0.0.1:8008 直接可达——和 WSL2 的 localhost 转发等价。

11//

12// 与 wsl-docker.js 完全同接口(bootstrap/status/restart/stop/dockerRestart/

13// recreate/update/upgrade/runContainer/readContainerToken),由 sidecar-ipc.js

14// 按平台分发:darwin → 本模块,win32 → wsl-docker.js。

15//

src/tools/system-tools.jsView file

4const { z } = require("zod"); L5: const { execSync } = require("child_process"); L6: ... L19: L20: if (process.platform === "linux") { L21: // 使用 wmctrl 获取窗口信息 ... L58: const baseUrl = L59: process.env.CICY_BASE_URL || `http://localhost:${process.env.PORT || 8101}`; L60: const thumbUrl = `${baseUrl}/files/screenshot/sys_win_${winId.replace(/^0x/, "")}.jpeg`; ... L107: const screenshotDir = path.join( L108: require("os").homedir(), L109: "cicy-files",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/system-tools.jsView on unpkg · L4

src/sidecar/wsl-docker.jsView file

16Trigger-reachable chain: manifest.main -> src/main.js -> src/tools/tab-browser-tools.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L28: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L29: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L30: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L39: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L40: "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/rootfs/cicy-wsl-latest.tar.gz"; L41: ... L63: } catch (e) { L64: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L65: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

16Trigger-reachable persistence chain: manifest.main -> src/main.js -> src/tools/tab-browser-tools.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L28: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L29: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L30: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L39: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L40: "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/rootfs/cicy-wsl-latest.tar.gz"; L41: ... L63: } catch (e) { L64: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L65

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.js

scripts/build-homepage.cjsView file

27console.log(`[build-homepage] $ ${cmd} (in ${path.relative(ROOT, cwd) || "."})`); L28: execSync(cmd, { cwd, stdio: "inherit" }); L29: } ... L32: if (!fs.existsSync(path.join(RENDER, "node_modules"))) { L33: run("npm install --no-audit --no-fund", RENDER); L34: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 846 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cicy-desktop@2.1.310 matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.310 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/main.jsView on unpkg

Source & flagged code

16 flagged · loading source

scripts/sync-runtime-deps.cjsView file

13L14: const { execSync } = require("child_process"); L15: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

bin/cicy-desktopView file

166if (isWindows) { L167: execFileSync("powershell", ["-NoProfile", "-Command", `Expand-Archive -LiteralPath "${dest}" -DestinationPath "${distDir}" -Force`], { stdio: "inherit" }); L168: } else {

High

Shell

Package source references shell execution.

bin/cicy-desktopView on unpkg · L166

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/cicy-desktop: const OSS_ELECTRON_MIRROR = "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/electron/"; const GH_ELECTRON_BASE = "https://github.[redacted]/"; const NPM_REGISTRY = process.env.CICY_NPM_REGISTRY || process.env.npm[redacted] || "https://registry.npmmirror.com"; ? path.join(prefix, "node_modules", "electron") // win: <prefix>\node_modules\electron : path.join(prefix, "lib", "node_modules", "electron"); // unix: <prefix>/lib/node_modules/electron execFileSync(curl, ["-sI", "--max-time", "2", "-o", nul, "https://www.google.com/generate_204"], { stdio: "ignore" }); fs.writeFileSync(path.join(bundledDir, "path.txt"), exe); //

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/cicy-desktopView on unpkg

src/tools/file-tools.jsView file

8L9: const FILES_DIR = path.join(require("os").homedir(), "cicy-files"); L10: ... L100: "file_upload", L101: "上传文件到服务器（base64编码），返回可访问的 URL", L102: z.object({ ... L122: const baseUrl = L123: process.env.CICY_BASE_URL || `http://localhost:${process.env.PORT || 8101}`; L124: const url = `${baseUrl}/files/${uniqueFilename}`;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/file-tools.jsView on unpkg · L8

src/sidecar/docker.jsView file

10// locally it's loaded from R2 (CN-friendly, no Docker Hub pull): L11: // https://r2.deepfetch.de5.net/docker/cicy-code-latest.tar.gz L12: // ... L14: const log = require("electron-log"); // bootstrap preflight failures must land in main.log L15: const { execFile, execFileSync, spawn } = require("child_process"); L16: const https = require("https"); ... L22: L23: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; L24: // Image tarball on Aliyun OSS (oss-cn-shanghai, public-read) — CN-domestic and ... L65: return new Promise((resolve, reject) => { L66: execFile(dockerBin(), args, { timeout, windowsHide: true }, (err, stdout, stderr) => { L67: if (err) { err.stdout = String(stdout || ""); err.stderr = String(stderr || ""); return reject(err); }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/sidecar/docker.jsView on unpkg · L10

src/sidecar/host-mihomo.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/sidecar/host-mihomo.jsView on unpkg · L20

20L21: const { spawn, execFile } = require("child_process"); L22: const fs = require("fs"); ... L24: const path = require("path"); L25: const https = require("https"); L26: const http = require("http"); ... L30: L31: const VER = (process.env.CICY_MIHOMO_VERSION || "v1.10.4").replace(/^v?/, "v"); L32: const OSS_BASE = process.env.CICY_OSS_BASE || "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com"; ... L44: const VERD = VER.replace(/^v/, ""); L45: const LOCAL_BIN = path.join(os.homedir(), ".local", "bin"); L46: const NEW_BIN = path.join(LOCAL_BIN, `mihomo-${VERD}${EXT}`);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/sidecar/host-mihomo.jsView on unpkg · L20

bin/cicy-desktop#virtual:normalized:round1View file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

src/sidecar/colima-docker.jsView file

26L27: const { execFile, spawn } = require("child_process"); L28: const path = require("path"); ... L33: // 专用 Colima profile —— 绝不动用户自己的默认 colima/docker。 L34: const PROFILE = process.env.CICY_COLIMA_PROFILE || "cicy-code"; L35: // Colima 给每个 profile 建一个 docker context,名字是 `colima-<profile>`。所有 ... L55: // ubuntu-24.04 + docker 的 cloudimg 即可,和 colima 版本解耦(用稳定 key,不跟版本号)。 L56: const OSS_BASE = process.env.CICY_OSS_BASE || "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com"; L57: const BASE_IMAGE_URL = process.env.CICY_COLIMA_BASE_URL || L58: `${OSS_BASE}/colima-base/ubuntu-2404-${ARCH_TAG}-docker.raw.gz`; L59: function baseImagePath() { return path.join(os.homedir(), "cicy-ai", "colima", `ubuntu-2404-${ARCH_TAG}-docker.raw.gz`); } L60:

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sidecar/colima-docker.jsView on unpkg · L26

src/tools/system-tools.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/system-tools.jsView on unpkg · L4

src/sidecar/wsl-docker.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

scripts/build-homepage.cjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 846 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/main.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/main.jsView on unpkg

Findings

5 Critical8 High5 Medium6 Low

CriticalSame File Env Network Executionsrc/sidecar/host-mihomo.js

CriticalPersistence Backdoorsrc/sidecar/colima-docker.js

CriticalDownload Executesrc/sidecar/host-mihomo.js

CriticalTrigger Reachable Dangerous Capabilitysrc/sidecar/wsl-docker.js

CriticalPrevious Version Dangerous Deltasrc/main.js

HighChild Processscripts/sync-runtime-deps.cjs

HighShellbin/cicy-desktop

HighEntrypoint Foreign Package Code Overwritebin/cicy-desktop

HighCommand Output Exfiltrationbin/cicy-desktop#virtual:normalized:round1

HighSandbox Evasion Gated Capabilitysrc/tools/system-tools.js

HighTrigger Reachable Command Output Exfiltrationbin/cicy-desktop#virtual:normalized:round1

HighTrigger Reachable Persistencesrc/sidecar/wsl-docker.js

HighRuntime Package Installscripts/build-homepage.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/sidecar/docker.js

MediumShips Build Helperbin/preinstall.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/tools/file-tools.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to cicy-desktop@2.1.312.

See version security history for other recorded verdicts.

Review the evidence and your use of cicy-desktop@2.1.312 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-28 14:43:24.051Z (UTC).