cicy-desktop@2.1.313: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

cicy-desktop@2.1.313: Suspicious npm security report (Warn) | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Host MCP tools register exec_shell and other exec/file helpers that run arbitrary commands on the machine.
The CLI downloads Electron from a vendor Aliyun OSS URL and unpacks it on first run.
When a desktop login token exists, the app probes public IP and geo and posts that to cicy-ai.com.
Runtime copies opaque cicy-code and mihomo binaries into ~/.local/bin from optional npm packages and OSS.
Chrome DevTools on 127.0.0.1:9221 is on by default with no authentication.
Scanner high findings overlap first-party product files, but bundled assets remain only partly inspectable so the dual-use surface cannot be certified clean.

Evidence against

package.json has no preinstall, install, or postinstall hook; prepublishOnly only rebuilds the homepage snapshot.
bin/preinstall.sh is not wired as an npm lifecycle script.
Reached hosts are vendor product endpoints, Electron/GitHub mirrors, and public IP-geo helpers, not a hidden dropper sink.
MCP HTTP is token-gated and opt-in; dangerous renderer RPC is gated except on nodeIntegration windows.
README and layout describe a user-launched Electron AI desktop, not a stealth implant.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 145 file(s), 1.76 MB of source, external domains: 127.0.0.1, api.ipapi.is, api.ipify.org, api.myip.com, cdn.npmmirror.com, chatgpt.com, cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com, cicy-1372193042.cos.ap-shanghai.myqcloud.com, cicy-ai.com, desktop.docker.com, example.com, g-electron.cicy.de5.net, gateway.cicy-ai.com, gemini.google.com, ghproxy.net, github.com, ip-api.com, ipinfo.io, mirrors.tuna.tsinghua.edu.cn, mirrors.ustc.edu.cn, nodejs.org, raw.githubusercontent.com, react.dev, registry.npmjs.org, registry.npmmirror.com, schemas.microsoft.com, web.telegram.org, wslstorestorage.blob.core.windows.net, www.apple.com, www.baidu.com, www.docker.com, www.douyin.com, www.google.com, www.gstatic.com, www.w3.org

Source & flagged code

27 flagged · loading source

scripts/sync-runtime-deps.cjsView file

13L14: const { execSync } = require("child_process"); L15: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

bin/cicy-desktopView file

166if (isWindows) { L167: execFileSync("powershell", ["-NoProfile", "-Command", `Expand-Archive -LiteralPath "${dest}" -DestinationPath "${distDir}" -Force`], { stdio: "inherit" }); L168: } else {

High

Shell

Package source references shell execution.

bin/cicy-desktopView on unpkg · L166

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = bin/cicy-desktop matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cicy-desktopView on unpkg

src/tools/file-tools.jsView file

8L9: const FILES_DIR = path.join(require("os").homedir(), "cicy-files"); L10: ... L100: "file_upload", L101: "上传文件到服务器（base64编码），返回可访问的 URL", L102: z.object({ ... L122: const baseUrl = L123: process.env.CICY_BASE_URL || `http://localhost:${process.env.PORT || 8101}`; L124: const url = `${baseUrl}/files/${uniqueFilename}`;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/file-tools.jsView on unpkg · L8

src/sidecar/docker.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/sidecar/docker.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/docker.jsView on unpkg

10// locally it's loaded from R2 (CN-friendly, no Docker Hub pull): L11: // https://r2.deepfetch.de5.net/docker/cicy-code-latest.tar.gz L12: // ... L14: const log = require("electron-log"); // bootstrap preflight failures must land in main.log L15: const { execFile, execFileSync, spawn } = require("child_process"); L16: const https = require("https"); ... L22: L23: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; L24: // Image tarball on Aliyun OSS (oss-cn-shanghai, public-read) — CN-domestic and ... L65: return new Promise((resolve, reject) => { L66: execFile(dockerBin(), args, { timeout, windowsHide: true }, (err, stdout, stderr) => { L67: if (err) { err.stdout = String(stdout || ""); err.stderr = String(stderr || ""); return reject(err); }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/sidecar/docker.jsView on unpkg · L10

src/sidecar/host-mihomo.jsView file

20L21: const { spawn, execFile } = require("child_process"); L22: const fs = require("fs"); ... L24: const path = require("path"); L25: const https = require("https"); L26: const http = require("http"); ... L30: L31: const VER = (process.env.CICY_MIHOMO_VERSION || "v1.10.4").replace(/^v?/, "v"); L32: const OSS_BASE = process.env.CICY_OSS_BASE || "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/sidecar/host-mihomo.jsView on unpkg · L20

20L21: const { spawn, execFile } = require("child_process"); L22: const fs = require("fs"); ... L24: const path = require("path"); L25: const https = require("https"); L26: const http = require("http"); ... L30: L31: const VER = (process.env.CICY_MIHOMO_VERSION || "v1.10.4").replace(/^v?/, "v"); L32: const OSS_BASE = process.env.CICY_OSS_BASE || "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com"; ... L44: const VERD = VER.replace(/^v/, ""); L45: const LOCAL_BIN = path.join(os.homedir(), ".local", "bin"); L46: const NEW_BIN = path.join(LOCAL_BIN, `mihomo-${VERD}${EXT}`);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/sidecar/host-mihomo.jsView on unpkg · L20

bin/cicy-desktop#virtual:normalized:round1View file

494// A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L495: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L496: // ... L500: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L501: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L502: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

494Trigger-reachable command-output exfiltration chain: scripts.start -> bin/cicy-desktop L494: // A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L495: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L496: // ... L500: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L501: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L502: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

src/sidecar/colima-docker.jsView file

26L27: const { execFile, spawn } = require("child_process"); L28: const path = require("path"); ... L33: // 专用 Colima profile —— 绝不动用户自己的默认 colima/docker。 L34: const PROFILE = process.env.CICY_COLIMA_PROFILE || "cicy-code"; L35: // Colima 给每个 profile 建一个 docker context,名字是 `colima-<profile>`。所有 ... L55: // ubuntu-24.04 + docker 的 cloudimg 即可,和 colima 版本解耦(用稳定 key,不跟版本号)。 L56: const OSS_BASE = process.env.CICY_OSS_BASE || "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com"; L57: const BASE_IMAGE_URL = process.env.CICY_COLIMA_BASE_URL || L58: `${OSS_BASE}/colima-base/ubuntu-2404-${ARCH_TAG}-docker.raw.gz`; L59: function baseImagePath() { return path.join(os.homedir(), "cicy-ai", "colima", `ubuntu-2404-${ARCH_TAG}-docker.raw.gz`); } L60:

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sidecar/colima-docker.jsView on unpkg · L26

src/tools/system-tools.jsView file

4const { z } = require("zod"); L5: const { execSync } = require("child_process"); L6: ... L19: L20: if (process.platform === "linux") { L21: // 使用 wmctrl 获取窗口信息 ... L58: const baseUrl = L59: process.env.CICY_BASE_URL || `http://localhost:${process.env.PORT || 8101}`; L60: const thumbUrl = `${baseUrl}/files/screenshot/sys_win_${winId.replace(/^0x/, "")}.jpeg`; ... L107: const screenshotDir = path.join( L108: require("os").homedir(), L109: "cicy-files",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/system-tools.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/tools/system-tools.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/system-tools.jsView on unpkg

src/sidecar/wsl-docker.jsView file

16Trigger-reachable chain: manifest.main -> src/main.js -> src/backends/local-teams.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L28: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L29: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L30: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L39: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L40: "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/rootfs/cicy-wsl-latest.tar.gz"; L41: ... L63: } catch (e) { L64: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L65: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

16Trigger-reachable persistence chain: manifest.main -> src/main.js -> src/backends/local-teams.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L28: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L29: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L30: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L39: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L40: "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/rootfs/cicy-wsl-latest.tar.gz"; L41: ... L63: } catch (e) { L64: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L65: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.js

scripts/build-homepage.cjsView file

27console.log(`[build-homepage] $ ${cmd} (in ${path.relative(ROOT, cwd) || "."})`); L28: execSync(cmd, { cwd, stdio: "inherit" }); L29: } ... L32: if (!fs.existsSync(path.join(RENDER, "node_modules"))) { L33: run("npm install --no-audit --no-fund", RENDER); L34: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 846 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/backends/local-teams.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/backends/local-teams.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/local-teams.jsView on unpkg

src/backends/window-manager.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/backends/window-manager.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/window-manager.jsView on unpkg

src/cloud/cloud-client.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/cloud/cloud-client.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cloud/cloud-client.jsView on unpkg

src/main-old.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/main-old.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main-old.jsView on unpkg

src/tools/exec-tools.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/tools/exec-tools.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/exec-tools.jsView on unpkg

src/backends/ipc.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/backends/ipc.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/ipc.jsView on unpkg

src/sidecar/localbin.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/sidecar/localbin.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/localbin.jsView on unpkg

src/sidecar/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/sidecar/runtime.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/runtime.jsView on unpkg

src/tabbrowser/redroid-matrix.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/tabbrowser/redroid-matrix.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tabbrowser/redroid-matrix.jsView on unpkg