registry / cicy-desktop / 2.1.325

cicy-desktop@2.1.325

CiCy - AI-powered operating system browser

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

At application runtime, the package can download native components and launch them as detached local processes. It also configures application login autostart by default.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Launching the Electron application; later user logins can relaunch it by default.

Impact

A compromised configured package registry or binary host could cause native code to run under the desktop user's account.

Mechanism

Remote native-binary retrieval followed by detached process execution.

AI rationale

This release has no npm install lifecycle trigger, but it automatically retrieves and executes remote native components during normal application use. That dangerous runtime capability warrants a warning rather than a block because malicious intent or a confirmed payload was not established from source.

Evidence

src/main.jssrc/sidecar/cicy-code.jssrc/sidecar/host-mihomo.js~/.local/node~/.local/bin/cicy-code~/.local/bin/mihomo~/cicy-ai/db/mihomo-host.yaml~/cicy-ai/db/mihomo-host.pid~/.config/autostart/cicy-desktop.desktop

Network endpoints5

cdn.npmmirror.comnodejs.orgregistry.npmjs.orgregistry.npmmirror.comr2.deepfetch.de5.net

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Launching the app automatically starts a local sidecar when port 8008 is unavailable.
The sidecar obtains a platform binary through npm and executes the resulting local binary.
A proxy binary is downloaded from a configurable remote URL, made executable, and started detached.
The app enables login autostart by default, allowing these runtime actions to recur.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The inspected network and process behavior is part of the desktop application's runtime setup rather than npm-install execution.
No credential harvesting or outbound secret exfiltration was confirmed in the inspected files.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 150 file(s), 1.82 MB of source, external domains: 127.0.0.1, api.cloudflare.com, api.ipapi.is, api.ipify.org, api.myip.com, cdn.npmmirror.com, chatgpt.com, cicy-1372193042.cos.ap-shanghai.myqcloud.com, cicy-ai.com, desktop.docker.com, example.com, g-electron.cicy.de5.net, gateway.cicy-ai.com, gemini.google.com, ghproxy.net, github.com, ip-api.com, ipinfo.io, mirrors.tuna.tsinghua.edu.cn, mirrors.ustc.edu.cn, nodejs.org, r2.deepfetch.de5.net, raw.githubusercontent.com, react.dev, registry.npmjs.org, registry.npmmirror.com, schemas.microsoft.com, web.telegram.org, ws.cicy-ai.com, wslstorestorage.blob.core.windows.net, www.apple.com, www.baidu.com, www.docker.com, www.douyin.com, www.facebook.com, www.google.com, www.gstatic.com, www.w3.org

Source & flagged code

17 flagged

scripts/sync-runtime-deps.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// SPDX-License-Identifier: Apache-2.0

5// Sync optionalDependencies to the LATEST published per-platform cicy-code and

6// cicy-mihomo subpackages, so every cicy-desktop build/publish bundles the

7// newest binaries. Run in CI before install/build (and before `npm publish`).

8//

9// (2026-06-08): Windows no longer ships msys2/tmux — the win sidecar

10// runs the single headless 团队助手 (--helper), so cicy-msys2-* is DROPPED here.

11//

12// Usage: node scripts/sync-runtime-deps.cjs (writes package.json in place)

14const { execSync } = require("child_process");

15const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

16const path = require("path");

18const REGISTRY = process.env.NPM_REGISTRY || "https://registry.npmjs.org";

19const PLATFORMS = ["darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64", "windows-x64", "windows-arm64"];

20const COMPONENTS = ["cicy-code", "cicy-mihomo"]; // NOT cicy-msys2 — win drops it

22function latest(pkg) {

23 // Use execSync (runs through a shell) instead of execFileSync: on Windows npm

24 // is npm.cmd, and Node refuses to spawn .cmd/.bat without a shell (EINVAL) —

25 // execFileSync('npm'|'npm.cmd', …) therefore threw on every call and the whole

26 // script aborted with "resolved nothing" even though the registry was fine.

27 // cmd.exe (win) / sh (unix) resolve `npm` correctly. pkg/REGISTRY are trusted

28 // constants, so the interpolation is safe.

29 try {

30 return execSync(`npm view ${pkg} version --registry=${REGISTRY}`, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;

31 } catch {

32 return null; // not published for this platform (e.g. cicy-code has no windows-arm64)

33 }

scripts/r2.mjsView file

Lines 1-66javascript

1#!/usr/bin/env node

2// scripts/r2.mjs — publish release assets to the Cloudflare R2 bucket.

3//

4// Replaces ossutil across the release workflows: one entry point that works

5// the same from bash (linux/mac) and pwsh (windows), so the upload steps stop

6// carrying three different CLIs.

7//

8// node scripts/r2.mjs put <key> <file> upload (overwrites)

9// node scripts/r2.mjs exists <key> exit 0 if the object is there

10// node scripts/r2.mjs list <prefix> print matching keys, one per line

src/tools/file-tools.jsView file

Lines 1-28javascript

2// SPDX-License-Identifier: Apache-2.0

4const { z } = require("zod");

5const fs = require("fs");

src/sidecar/docker.jsView file

Lines 1-30javascript

2// SPDX-License-Identifier: Apache-2.0

4// Windows sidecar backend: run cicy-code inside a Docker container.

5//

6// Platform split (2026-06): mac/linux start cicy-code locally via `npx

7// cicy-code` (see cicy-code.js); Windows runs it in Docker Desktop instead.

8// The base-env image's entrypoint installs cicy-code from npm at container

9// startup, so the image is version-independent. If the image isn't present

10// locally it's loaded from our R2 bucket (no Docker Hub pull):

src/sidecar/host-mihomo.jsView file

Lines 1-40javascript

2// SPDX-License-Identifier: Apache-2.0

4// Host-side mihomo for the Chrome per-profile proxy.

5//

6// docker-only put mihomo INSIDE the cicy-code container. But the system Chrome

7// runs on the HOST (mac/win/linux), and its per-profile proxy points at

8// 127.0.0.1:2000N — which a container CANNOT reliably serve through colima/WSL

9// port-forwarding (the per-profile listeners bind 127.0.0.1 inside the container;

10// publishing the 20001-32 range through colima/Lima never reached them → Chrome

src/sidecar/colima-docker.jsView file

Lines 6-46javascript

6// macOS 没有 WSL。对应 Windows 端「不装 Docker Desktop GUI、用确定性命令驱动

7// Docker 引擎」的方案,在 Mac 上就是 Colima:一个 Apache-2.0、纯 CLI、无 GUI、

8// 无授权、无 root 的轻量 Linux VM(基于 Lima),里面跑标准 Docker 引擎。Lima 会

9// 把 VM 内监听 127.0.0.1 的端口自动转发到宿主 127.0.0.1,所以 VM 里发布在

10// :8008 的容器,Mac 上 127.0.0.1:8008 直接可达——和 WSL2 的 localhost 转发等价。

11//

12// 与 wsl-docker.js 完全同接口(bootstrap/status/restart/stop/dockerRestart/

13// recreate/update/upgrade/runContainer/readContainerToken),由 sidecar-ipc.js

14// 按平台分发:darwin → 本模块,win32 → wsl-docker.js。

15//

src/sidecar/wsl-docker.jsView file

16Trigger-reachable chain: manifest.main -> src/main.js -> src/backends/hub-client.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L29: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L30: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L31: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L40: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L41: "https://r2.deepfetch.de5.net/rootfs/cicy-wsl-latest.tar.gz"; L42: ... L64: } catch (e) { L65: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L66: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

16Trigger-reachable persistence chain: manifest.main -> src/main.js -> src/backends/hub-client.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L29: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L30: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L31: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L40: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L41: "https://r2.deepfetch.de5.net/rootfs/cicy-wsl-latest.tar.gz"; L42: ... L64: } catch (e) { L65: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L66: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

bin/cicy-desktop#virtual:normalized:round1View file

495Trigger-reachable command-output exfiltration chain: scripts.start -> bin/cicy-desktop L495: // A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L496: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L497: // ... L501: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L502: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L503: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L495

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/cicy-desktop#virtual:normalized:round1View on unpkg

scripts/build-homepage.cjsView file

27console.log(`[build-homepage] $ ${cmd} (in ${path.relative(ROOT, cwd) || "."})`); L28: execSync(cmd, { cwd, stdio: "inherit" }); L29: } ... L32: if (!fs.existsSync(path.join(RENDER, "node_modules"))) { L33: run("npm install --no-audit --no-fund", RENDER); L34: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 815 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/backends/sidecar-ipc.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cicy-desktop@2.1.312 matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.312 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/backends/sidecar-ipc.jsView on unpkg

Source & flagged code

17 flagged · loading source

scripts/sync-runtime-deps.cjsView file

13L14: const { execSync } = require("child_process"); L15: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

scripts/r2.mjsView file

46// Windows: npx is npx.cmd, which Node only spawns with shell:true — and then L47: // cmd.exe re-parses the argv, so anything with a space ("CiCy Desktop Setup L48: // 2.1.324.exe") must be quoted or it arrives as several arguments.

High

Shell

Package source references shell execution.

scripts/r2.mjsView on unpkg · L46

17// R2_BUCKET default: cicy-assets-poc L18: // R2_PUBLIC_BASE default: https://r2.deepfetch.de5.net L19: // ... L24: L25: import { spawnSync } from "node:child_process"; L26: import { pathToFileURL } from "node:url"; ... L28: L29: const BUCKET = process.env.R2_BUCKET || "cicy-assets-poc"; L30: const PUBLIC_BASE = (process.env.R2_PUBLIC_BASE || "https://r2.deepfetch.de5.net").replace(/\/$/, ""); ... L37: function die(msg, code = 1) { L38: process.stderr.write(`r2: ${msg}\n`); L39: process.exit(code);

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

scripts/r2.mjsView on unpkg · L17

24L25: import { spawnSync } from "node:child_process"; L26: import { pathToFileURL } from "node:url"; ... L29: const BUCKET = process.env.R2_BUCKET || "cicy-assets-poc"; L30: const PUBLIC_BASE = (process.env.R2_PUBLIC_BASE || "https://r2.deepfetch.de5.net").replace(/\/$/, ""); L31: const ACCOUNT = process.env.R2_ACCOUNT_ID || ""; ... L37: function die(msg, code = 1) { L38: process.stderr.write(`r2: ${msg}\n`); L39: process.exit(code);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/r2.mjsView on unpkg · L24

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/r2.mjsView on unpkg · L17

src/tools/file-tools.jsView file

8L9: const FILES_DIR = path.join(require("os").homedir(), "cicy-files"); L10: ... L100: "file_upload", L101: "上传文件到服务器（base64编码），返回可访问的 URL", L102: z.object({ ... L122: const baseUrl = L123: process.env.CICY_BASE_URL || `http://localhost:${process.env.PORT || 8101}`; L124: const url = `${baseUrl}/files/${uniqueFilename}`;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/file-tools.jsView on unpkg · L8

src/sidecar/docker.jsView file

10// locally it's loaded from our R2 bucket (no Docker Hub pull): L11: // https://r2.deepfetch.de5.net/images/cicy-code-latest.tar.gz L12: // ... L14: const log = require("electron-log"); // bootstrap preflight failures must land in main.log L15: const { execFile, execFileSync, spawn } = require("child_process"); L16: const https = require("https"); ... L22: L23: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; L24: // Image tarball on Cloudflare R2 (public bucket). The Aliyun OSS mirror it used ... L67: return new Promise((resolve, reject) => { L68: execFile(dockerBin(), args, { timeout, windowsHide: true }, (err, stdout, stderr) => { L69: if (err) { err.stdout = String(stdout || ""); err.stderr = String(stderr || ""); return reject(err); }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/sidecar/docker.jsView on unpkg · L10

src/sidecar/host-mihomo.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/sidecar/host-mihomo.jsView on unpkg · L20

20L21: const { spawn, execFile } = require("child_process"); L22: const fs = require("fs"); ... L24: const path = require("path"); L25: const https = require("https"); L26: const http = require("http"); ... L30: L31: const VER = (process.env.CICY_MIHOMO_VERSION || "v1.10.4").replace(/^v?/, "v"); L32: const R2_BASE = process.env.CICY_R2_BASE || process.env.CICY_OSS_BASE || "https://r2.deepfetch.de5.net"; ... L44: const VERD = VER.replace(/^v/, ""); L45: const LOCAL_BIN = path.join(os.homedir(), ".local", "bin"); L46: const NEW_BIN = path.join(LOCAL_BIN, `mihomo-${VERD}${EXT}`);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/sidecar/host-mihomo.jsView on unpkg · L20

src/sidecar/colima-docker.jsView file

26L27: const { execFile, spawn } = require("child_process"); L28: const path = require("path"); ... L33: // 专用 Colima profile —— 绝不动用户自己的默认 colima/docker。 L34: const PROFILE = process.env.CICY_COLIMA_PROFILE || "cicy-code"; L35: // Colima 给每个 profile 建一个 docker context,名字是 `colima-<profile>`。所有 ... L64: // Xcode/CLT —— colima/docker 都是预编译 bottle,无编译步骤)。可用环境变量换 CN 镜像。 L65: const BREW_TARBALL = process.env.CICY_BREW_TARBALL || "https://github.[redacted]"; L66: ... L70: execFile("bash", ["-lc", cmd], { timeout, env: shEnv(), maxBuffer: 1 << 26 }, L71: (err, stdout, stderr) => { L72: if (err) { err.stdout = String(stdout || ""); err.stderr = String(stderr || ""); return reject(err); }

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sidecar/colima-docker.jsView on unpkg · L26

src/sidecar/wsl-docker.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

bin/cicy-desktop#virtual:normalized:round1View file

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L495

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/cicy-desktop#virtual:normalized:round1View on unpkg

scripts/build-homepage.cjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 815 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/backends/sidecar-ipc.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/backends/sidecar-ipc.jsView on unpkg

Findings

5 Critical9 High5 Medium6 Low

CriticalSame File Env Network Executionsrc/sidecar/host-mihomo.js

CriticalPersistence Backdoorsrc/sidecar/colima-docker.js

CriticalDownload Executesrc/sidecar/host-mihomo.js

CriticalTrigger Reachable Dangerous Capabilitysrc/sidecar/wsl-docker.js

CriticalPrevious Version Dangerous Deltasrc/backends/sidecar-ipc.js

HighChild Processscripts/sync-runtime-deps.cjs

HighShellscripts/r2.mjs

HighCredential Exfiltrationscripts/r2.mjs

HighCommand Output Exfiltrationscripts/r2.mjs

HighSandbox Evasion Gated Capabilityscripts/r2.mjs

HighTrigger Reachable Command Output Exfiltrationbin/cicy-desktop#virtual:normalized:round1

HighTrigger Reachable Persistencesrc/sidecar/wsl-docker.js

HighRuntime Package Installscripts/build-homepage.cjs

HighSemantic Analysis Limitedbin/cicy-desktop#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/sidecar/docker.js

MediumShips Build Helperbin/preinstall.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/tools/file-tools.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to cicy-desktop@2.1.325.

See version security history for other recorded verdicts.

Review the evidence and your use of cicy-desktop@2.1.325 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-30 19:35:15.864Z (UTC).