cicy-desktop@2.1.319: Suspicious npm security report (Warn)

Loading npm security reports…

cicy-desktop@2.1.319: Suspicious npm security report (Warn) | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Runtime MCP and RPC tools execute arbitrary host shell, Python, and Node commands and can read or write files.
The electron_inject tool writes JavaScript under a user-home inject directory for later execution.
First run copies or downloads native sidecars and Electron from npm or Aliyun OSS into the user profile.
After login the app registers a stable machine id plus public IP and geo with cicy-ai.com.
The HTTP API advertises remote tool access with CORS open to any origin.
Consumer install has no preinstall or postinstall hook, but minified UI and native sidecar coverage is incomplete so residual dual-use risk remains.

Evidence against

package.json has no preinstall, install, or postinstall scripts; only prepublishOnly rebuilds the homepage.
MCP routes use auth middleware and tokens stored in ~/cicy-ai/global.json.
Dangerous renderer RPC calls prompt for user consent.
Cloud HTTP calls no-op when the user is not logged in.
Inspectable source matches an Electron AI desktop automation product, not a hidden dropper.
No webhook, Discord, eval, or obfuscated install-time payload was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 147 file(s), 1.78 MB of source, external domains: 127.0.0.1, api.ipapi.is, api.ipify.org, api.myip.com, cdn.npmmirror.com, chatgpt.com, cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com, cicy-1372193042.cos.ap-shanghai.myqcloud.com, cicy-ai.com, desktop.docker.com, example.com, g-electron.cicy.de5.net, gateway.cicy-ai.com, gemini.google.com, ghproxy.net, github.com, ip-api.com, ipinfo.io, mirrors.tuna.tsinghua.edu.cn, mirrors.ustc.edu.cn, nodejs.org, raw.githubusercontent.com, react.dev, registry.npmjs.org, registry.npmmirror.com, schemas.microsoft.com, web.telegram.org, wslstorestorage.blob.core.windows.net, www.apple.com, www.baidu.com, www.docker.com, www.douyin.com, www.facebook.com, www.google.com, www.gstatic.com, www.w3.org

Source & flagged code

27 flagged

scripts/sync-runtime-deps.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// SPDX-License-Identifier: Apache-2.0

5// Sync optionalDependencies to the LATEST published per-platform cicy-code and

6// cicy-mihomo subpackages, so every cicy-desktop build/publish bundles the

7// newest binaries. Run in CI before install/build (and before `npm publish`).

8//

9// (2026-06-08): Windows no longer ships msys2/tmux — the win sidecar

10// runs the single headless 团队助手 (--helper), so cicy-msys2-* is DROPPED here.

11//

12// Usage: node scripts/sync-runtime-deps.cjs (writes package.json in place)

14const { execSync } = require("child_process");

15const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

16const path = require("path");

18const REGISTRY = process.env.NPM_REGISTRY || "https://registry.npmjs.org";

19const PLATFORMS = ["darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64", "windows-x64", "windows-arm64"];

20const COMPONENTS = ["cicy-code", "cicy-mihomo"]; // NOT cicy-msys2 — win drops it

22function latest(pkg) {

23 // Use execSync (runs through a shell) instead of execFileSync: on Windows npm

24 // is npm.cmd, and Node refuses to spawn .cmd/.bat without a shell (EINVAL) —

25 // execFileSync('npm'|'npm.cmd', …) therefore threw on every call and the whole

26 // script aborted with "resolved nothing" even though the registry was fine.

27 // cmd.exe (win) / sh (unix) resolve `npm` correctly. pkg/REGISTRY are trusted

28 // constants, so the interpolation is safe.

29 try {

30 return execSync(`npm view ${pkg} version --registry=${REGISTRY}`, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;

31 } catch {

32 return null; // not published for this platform (e.g. cicy-code has no windows-arm64)

33 }

bin/cicy-desktopView file

Lines 146-186text

146 try { fs.mkdirSync(dlDir, { recursive: true }); } catch {}

147 const dest = path.join(dlDir, zip);

148 const expected = remoteContentLength(curl, url);

149 let localSz = 0; try { localSz = fs.statSync(dest).size; } catch {}

150 const complete = localSz >= 50 * 1024 * 1024 && (!expected || localSz === expected);

151 if (complete) {

152 console.log(`[ok] 复用已下载的 Electron:${dest}`);

153 } else {

154 const resuming = localSz > 0;

155 console.log(` 下载 Electron ${ELECTRON_VERSION}(来源:${src}${resuming ? ",断点续传" : ""})→ ${dest}`);

156 // -C - 断点续传(部分则 206 续,缺则 200 全下);-# 进度条;inherit 让进度条画到终端。

157

src/tools/file-tools.jsView file

Lines 1-28javascript

2// SPDX-License-Identifier: Apache-2.0

4const { z } = require("zod");

5const fs = require("fs");

src/sidecar/docker.jsView file

Lines 1-30javascript

2// SPDX-License-Identifier: Apache-2.0

4// Windows sidecar backend: run cicy-code inside a Docker container.

5//

6// Platform split (2026-06): mac/linux start cicy-code locally via `npx

7// cicy-code` (see cicy-code.js); Windows runs it in Docker Desktop instead.

8// The base-env image's entrypoint installs cicy-code from npm at container

9// startup, so the image is version-independent. If the image isn't present

10// locally it's loaded from R2 (CN-friendly, no Docker Hub pull):

src/sidecar/host-mihomo.jsView file

Lines 1-40javascript

2// SPDX-License-Identifier: Apache-2.0

4// Host-side mihomo for the Chrome per-profile proxy.

5//

6// docker-only put mihomo INSIDE the cicy-code container. But the system Chrome

7// runs on the HOST (mac/win/linux), and its per-profile proxy points at

8// 127.0.0.1:2000N — which a container CANNOT reliably serve through colima/WSL

9// port-forwarding (the per-profile listeners bind 127.0.0.1 inside the container;

10// publishing the 20001-32 range through colima/Lima never reached them → Chrome

bin/cicy-desktop#virtual:normalized:round1View file

494// A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L495: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L496: // ... L500: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L501: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L502: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

494Trigger-reachable command-output exfiltration chain: scripts.start -> bin/cicy-desktop L494: // A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L495: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L496: // ... L500: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L501: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L502: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

src/sidecar/colima-docker.jsView file

Lines 6-46javascript

6// macOS 没有 WSL。对应 Windows 端「不装 Docker Desktop GUI、用确定性命令驱动

7// Docker 引擎」的方案,在 Mac 上就是 Colima:一个 Apache-2.0、纯 CLI、无 GUI、

8// 无授权、无 root 的轻量 Linux VM(基于 Lima),里面跑标准 Docker 引擎。Lima 会

9// 把 VM 内监听 127.0.0.1 的端口自动转发到宿主 127.0.0.1,所以 VM 里发布在

10// :8008 的容器,Mac 上 127.0.0.1:8008 直接可达——和 WSL2 的 localhost 转发等价。

11//

12// 与 wsl-docker.js 完全同接口(bootstrap/status/restart/stop/dockerRestart/

13// recreate/update/upgrade/runContainer/readContainerToken),由 sidecar-ipc.js

14// 按平台分发:darwin → 本模块,win32 → wsl-docker.js。

15//

src/tools/system-tools.jsView file

4const { z } = require("zod"); L5: const { execSync } = require("child_process"); L6: ... L19: L20: if (process.platform === "linux") { L21: // 使用 wmctrl 获取窗口信息 ... L58: const baseUrl = L59: process.env.CICY_BASE_URL || `http://localhost:${process.env.PORT || 8101}`; L60: const thumbUrl = `${baseUrl}/files/screenshot/sys_win_${winId.replace(/^0x/, "")}.jpeg`; ... L107: const screenshotDir = path.join( L108: require("os").homedir(), L109: "cicy-files",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/system-tools.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/tools/system-tools.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/system-tools.jsView on unpkg

src/sidecar/wsl-docker.jsView file

16Trigger-reachable chain: manifest.main -> src/main.js -> src/backends/local-teams.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L29: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L30: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L31: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L40: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L41: "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/rootfs/cicy-wsl-latest.tar.gz"; L42: ... L64: } catch (e) { L65: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L66: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

16Trigger-reachable persistence chain: manifest.main -> src/main.js -> src/backends/local-teams.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L29: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L30: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L31: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L40: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L41: "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com/rootfs/cicy-wsl-latest.tar.gz"; L42: ... L64: } catch (e) { L65: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L66: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.js

scripts/build-homepage.cjsView file

27console.log(`[build-homepage] $ ${cmd} (in ${path.relative(ROOT, cwd) || "."})`); L28: execSync(cmd, { cwd, stdio: "inherit" }); L29: } ... L32: if (!fs.existsSync(path.join(RENDER, "node_modules"))) { L33: run("npm install --no-audit --no-fund", RENDER); L34: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 846 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/backends/local-teams.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/backends/local-teams.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/local-teams.jsView on unpkg

src/backends/window-manager.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/backends/window-manager.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/window-manager.jsView on unpkg

src/cloud/cloud-client.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/cloud/cloud-client.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cloud/cloud-client.jsView on unpkg

src/main-old.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/main-old.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main-old.jsView on unpkg

src/tools/exec-tools.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/tools/exec-tools.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/exec-tools.jsView on unpkg

src/backends/ipc.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/backends/ipc.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/ipc.jsView on unpkg

src/sidecar/localbin.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/sidecar/localbin.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/localbin.jsView on unpkg

src/sidecar/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/sidecar/runtime.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/runtime.jsView on unpkg

Source & flagged code

27 flagged · loading source

scripts/sync-runtime-deps.cjsView file

13L14: const { execSync } = require("child_process"); L15: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

bin/cicy-desktopView file

166if (isWindows) { L167: execFileSync("powershell", ["-NoProfile", "-Command", `Expand-Archive -LiteralPath "${dest}" -DestinationPath "${distDir}" -Force`], { stdio: "inherit" }); L168: } else {

High

Shell

Package source references shell execution.

bin/cicy-desktopView on unpkg · L166

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = bin/cicy-desktop matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cicy-desktopView on unpkg

src/tools/file-tools.jsView file

8L9: const FILES_DIR = path.join(require("os").homedir(), "cicy-files"); L10: ... L100: "file_upload", L101: "上传文件到服务器（base64编码），返回可访问的 URL", L102: z.object({ ... L122: const baseUrl = L123: process.env.CICY_BASE_URL || `http://localhost:${process.env.PORT || 8101}`; L124: const url = `${baseUrl}/files/${uniqueFilename}`;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/file-tools.jsView on unpkg · L8

src/sidecar/docker.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.360 matchedPath = src/sidecar/docker.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.360 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/docker.jsView on unpkg

10// locally it's loaded from R2 (CN-friendly, no Docker Hub pull): L11: // https://r2.deepfetch.de5.net/docker/cicy-code-latest.tar.gz L12: // ... L14: const log = require("electron-log"); // bootstrap preflight failures must land in main.log L15: const { execFile, execFileSync, spawn } = require("child_process"); L16: const https = require("https"); ... L22: L23: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; L24: // Image tarball on Aliyun OSS (oss-cn-shanghai, public-read) — CN-domestic and ... L65: return new Promise((resolve, reject) => { L66: execFile(dockerBin(), args, { timeout, windowsHide: true }, (err, stdout, stderr) => { L67: if (err) { err.stdout = String(stdout || ""); err.stderr = String(stderr || ""); return reject(err); }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/sidecar/docker.jsView on unpkg · L10

src/sidecar/host-mihomo.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/sidecar/host-mihomo.jsView on unpkg · L20

20L21: const { spawn, execFile } = require("child_process"); L22: const fs = require("fs"); ... L24: const path = require("path"); L25: const https = require("https"); L26: const http = require("http"); ... L30: L31: const VER = (process.env.CICY_MIHOMO_VERSION || "v1.10.4").replace(/^v?/, "v"); L32: const OSS_BASE = process.env.CICY_OSS_BASE || "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com"; ... L44: const VERD = VER.replace(/^v/, ""); L45: const LOCAL_BIN = path.join(os.homedir(), ".local", "bin"); L46: const NEW_BIN = path.join(LOCAL_BIN, `mihomo-${VERD}${EXT}`);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/sidecar/host-mihomo.jsView on unpkg · L20

bin/cicy-desktop#virtual:normalized:round1View file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

src/sidecar/colima-docker.jsView file

26L27: const { execFile, spawn } = require("child_process"); L28: const path = require("path"); ... L33: // 专用 Colima profile —— 绝不动用户自己的默认 colima/docker。 L34: const PROFILE = process.env.CICY_COLIMA_PROFILE || "cicy-code"; L35: // Colima 给每个 profile 建一个 docker context,名字是 `colima-<profile>`。所有 ... L55: // ubuntu-24.04 + docker 的 cloudimg 即可,和 colima 版本解耦(用稳定 key,不跟版本号)。 L56: const OSS_BASE = process.env.CICY_OSS_BASE || "https://cicy-1372193042-cn.oss-cn-shanghai.aliyuncs.com"; L57: const BASE_IMAGE_URL = process.env.CICY_COLIMA_BASE_URL || L58: `${OSS_BASE}/colima-base/ubuntu-2404-${ARCH_TAG}-docker.raw.gz`; L59: function baseImagePath() { return path.join(os.homedir(), "cicy-ai", "colima", `ubuntu-2404-${ARCH_TAG}-docker.raw.gz`); } L60:

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sidecar/colima-docker.jsView on unpkg · L26

src/tools/system-tools.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/system-tools.jsView on unpkg · L4

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/system-tools.jsView on unpkg

src/sidecar/wsl-docker.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.js

scripts/build-homepage.cjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 846 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/backends/local-teams.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/local-teams.jsView on unpkg

src/backends/window-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/window-manager.jsView on unpkg

src/cloud/cloud-client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cloud/cloud-client.jsView on unpkg

src/main-old.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main-old.jsView on unpkg

src/tools/exec-tools.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/exec-tools.jsView on unpkg

src/backends/ipc.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/ipc.jsView on unpkg

src/sidecar/localbin.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/localbin.jsView on unpkg

src/sidecar/runtime.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/runtime.jsView on unpkg

Source & flagged code

27 flagged

scripts/sync-runtime-deps.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// SPDX-License-Identifier: Apache-2.0

5// Sync optionalDependencies to the LATEST published per-platform cicy-code and

6// cicy-mihomo subpackages, so every cicy-desktop build/publish bundles the

7// newest binaries. Run in CI before install/build (and before `npm publish`).

8//

9// (2026-06-08): Windows no longer ships msys2/tmux — the win sidecar

10// runs the single headless 团队助手 (--helper), so cicy-msys2-* is DROPPED here.

11//

12// Usage: node scripts/sync-runtime-deps.cjs (writes package.json in place)

14const { execSync } = require("child_process");

15const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

16const path = require("path");

18const REGISTRY = process.env.NPM_REGISTRY || "https://registry.npmjs.org";

19const PLATFORMS = ["darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64", "windows-x64", "windows-arm64"];

20const COMPONENTS = ["cicy-code", "cicy-mihomo"]; // NOT cicy-msys2 — win drops it

22function latest(pkg) {

23 // Use execSync (runs through a shell) instead of execFileSync: on Windows npm

24 // is npm.cmd, and Node refuses to spawn .cmd/.bat without a shell (EINVAL) —

25 // execFileSync('npm'|'npm.cmd', …) therefore threw on every call and the whole

26 // script aborted with "resolved nothing" even though the registry was fine.

27 // cmd.exe (win) / sh (unix) resolve `npm` correctly. pkg/REGISTRY are trusted

28 // constants, so the interpolation is safe.

29 try {

30 return execSync(`npm view ${pkg} version --registry=${REGISTRY}`, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;

31 } catch {

32 return null; // not published for this platform (e.g. cicy-code has no windows-arm64)

33 }

bin/cicy-desktopView file

Lines 146-186text

146 try { fs.mkdirSync(dlDir, { recursive: true }); } catch {}

147 const dest = path.join(dlDir, zip);

148 const expected = remoteContentLength(curl, url);

149 let localSz = 0; try { localSz = fs.statSync(dest).size; } catch {}

150 const complete = localSz >= 50 * 1024 * 1024 && (!expected || localSz === expected);

151 if (complete) {

152 console.log(`[ok] 复用已下载的 Electron:${dest}`);

153 } else {

154 const resuming = localSz > 0;

155 console.log(` 下载 Electron ${ELECTRON_VERSION}(来源:${src}${resuming ? ",断点续传" : ""})→ ${dest}`);

156 // -C - 断点续传(部分则 206 续,缺则 200 全下);-# 进度条;inherit 让进度条画到终端。

157

src/tools/file-tools.jsView file

Lines 1-28javascript

2// SPDX-License-Identifier: Apache-2.0

4const { z } = require("zod");

5const fs = require("fs");

src/sidecar/docker.jsView file

Lines 1-30javascript

2// SPDX-License-Identifier: Apache-2.0

4// Windows sidecar backend: run cicy-code inside a Docker container.

5//

6// Platform split (2026-06): mac/linux start cicy-code locally via `npx

7// cicy-code` (see cicy-code.js); Windows runs it in Docker Desktop instead.

8// The base-env image's entrypoint installs cicy-code from npm at container

9// startup, so the image is version-independent. If the image isn't present

10// locally it's loaded from R2 (CN-friendly, no Docker Hub pull):

src/sidecar/host-mihomo.jsView file

Lines 1-40javascript

2// SPDX-License-Identifier: Apache-2.0

4// Host-side mihomo for the Chrome per-profile proxy.

5//

6// docker-only put mihomo INSIDE the cicy-code container. But the system Chrome

7// runs on the HOST (mac/win/linux), and its per-profile proxy points at

8// 127.0.0.1:2000N — which a container CANNOT reliably serve through colima/WSL

9// port-forwarding (the per-profile listeners bind 127.0.0.1 inside the container;

10// publishing the 20001-32 range through colima/Lima never reached them → Chrome

bin/cicy-desktop#virtual:normalized:round1View file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L494

src/sidecar/colima-docker.jsView file

Lines 6-46javascript

6// macOS 没有 WSL。对应 Windows 端「不装 Docker Desktop GUI、用确定性命令驱动

7// Docker 引擎」的方案,在 Mac 上就是 Colima:一个 Apache-2.0、纯 CLI、无 GUI、

8// 无授权、无 root 的轻量 Linux VM(基于 Lima),里面跑标准 Docker 引擎。Lima 会

9// 把 VM 内监听 127.0.0.1 的端口自动转发到宿主 127.0.0.1,所以 VM 里发布在

10// :8008 的容器,Mac 上 127.0.0.1:8008 直接可达——和 WSL2 的 localhost 转发等价。

11//

12// 与 wsl-docker.js 完全同接口(bootstrap/status/restart/stop/dockerRestart/

13// recreate/update/upgrade/runContainer/readContainerToken),由 sidecar-ipc.js

14// 按平台分发:darwin → 本模块,win32 → wsl-docker.js。

15//

src/tools/system-tools.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/system-tools.jsView on unpkg · L4

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/system-tools.jsView on unpkg

src/sidecar/wsl-docker.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.js

scripts/build-homepage.cjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 846 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/backends/local-teams.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/local-teams.jsView on unpkg

src/backends/window-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/window-manager.jsView on unpkg

src/cloud/cloud-client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cloud/cloud-client.jsView on unpkg

src/main-old.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main-old.jsView on unpkg

src/tools/exec-tools.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/exec-tools.jsView on unpkg

src/backends/ipc.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/ipc.jsView on unpkg

src/sidecar/localbin.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/localbin.jsView on unpkg

src/sidecar/runtime.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/runtime.jsView on unpkg

cicy-desktop@2.1.319

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code