cicy-desktop@2.1.327: Suspicious npm security report (Warn)

Loading npm security reports…

cicy-desktop@2.1.327: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

17 flagged

scripts/sync-runtime-deps.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// SPDX-License-Identifier: Apache-2.0

5// Sync optionalDependencies to the LATEST published per-platform cicy-code and

6// cicy-mihomo subpackages, so every cicy-desktop build/publish bundles the

7// newest binaries. Run in CI before install/build (and before `npm publish`).

8//

9// (2026-06-08): Windows no longer ships msys2/tmux — the win sidecar

10// runs the single headless 团队助手 (--helper), so cicy-msys2-* is DROPPED here.

11//

12// Usage: node scripts/sync-runtime-deps.cjs (writes package.json in place)

14const { execSync } = require("child_process");

15const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

16const path = require("path");

18const REGISTRY = process.env.NPM_REGISTRY || "https://registry.npmjs.org";

19const PLATFORMS = ["darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64", "windows-x64", "windows-arm64"];

20const COMPONENTS = ["cicy-code", "cicy-mihomo"]; // NOT cicy-msys2 — win drops it

22function latest(pkg) {

23 // Use execSync (runs through a shell) instead of execFileSync: on Windows npm

24 // is npm.cmd, and Node refuses to spawn .cmd/.bat without a shell (EINVAL) —

25 // execFileSync('npm'|'npm.cmd', …) therefore threw on every call and the whole

26 // script aborted with "resolved nothing" even though the registry was fine.

27 // cmd.exe (win) / sh (unix) resolve `npm` correctly. pkg/REGISTRY are trusted

28 // constants, so the interpolation is safe.

29 try {

30 return execSync(`npm view ${pkg} version --registry=${REGISTRY}`, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;

31 } catch {

32 return null; // not published for this platform (e.g. cicy-code has no windows-arm64)

33 }

scripts/r2.mjsView file

Lines 1-66javascript

1#!/usr/bin/env node

2// scripts/r2.mjs — publish release assets to the Cloudflare R2 bucket.

3//

4// Replaces ossutil across the release workflows: one entry point that works

5// the same from bash (linux/mac) and pwsh (windows), so the upload steps stop

6// carrying three different CLIs.

7//

8// node scripts/r2.mjs put <key> <file> upload (overwrites)

9// node scripts/r2.mjs exists <key> exit 0 if the object is there

10// node scripts/r2.mjs list <prefix> print matching keys, one per line

src/tools/file-tools.jsView file

Lines 1-28javascript

2// SPDX-License-Identifier: Apache-2.0

4const { z } = require("zod");

5const fs = require("fs");

src/sidecar/docker.jsView file

Lines 1-30javascript

2// SPDX-License-Identifier: Apache-2.0

4// Windows sidecar backend: run cicy-code inside a Docker container.

5//

6// Platform split (2026-06): mac/linux start cicy-code locally via `npx

7// cicy-code` (see cicy-code.js); Windows runs it in Docker Desktop instead.

8// The base-env image's entrypoint installs cicy-code from npm at container

9// startup, so the image is version-independent. If the image isn't present

10// locally it's loaded from our R2 bucket (no Docker Hub pull):

src/sidecar/host-mihomo.jsView file

Lines 1-40javascript

2// SPDX-License-Identifier: Apache-2.0

4// Host-side mihomo for the Chrome per-profile proxy.

5//

6// docker-only put mihomo INSIDE the cicy-code container. But the system Chrome

7// runs on the HOST (mac/win/linux), and its per-profile proxy points at

8// 127.0.0.1:2000N — which a container CANNOT reliably serve through colima/WSL

9// port-forwarding (the per-profile listeners bind 127.0.0.1 inside the container;

10// publishing the 20001-32 range through colima/Lima never reached them → Chrome

src/sidecar/colima-docker.jsView file

Lines 6-46javascript

6// macOS 没有 WSL。对应 Windows 端「不装 Docker Desktop GUI、用确定性命令驱动

7// Docker 引擎」的方案,在 Mac 上就是 Colima:一个 Apache-2.0、纯 CLI、无 GUI、

8// 无授权、无 root 的轻量 Linux VM(基于 Lima),里面跑标准 Docker 引擎。Lima 会

9// 把 VM 内监听 127.0.0.1 的端口自动转发到宿主 127.0.0.1,所以 VM 里发布在

10// :8008 的容器,Mac 上 127.0.0.1:8008 直接可达——和 WSL2 的 localhost 转发等价。

11//

12// 与 wsl-docker.js 完全同接口(bootstrap/status/restart/stop/dockerRestart/

13// recreate/update/upgrade/runContainer/readContainerToken),由 sidecar-ipc.js

14// 按平台分发:darwin → 本模块,win32 → wsl-docker.js。

15//

src/sidecar/wsl-docker.jsView file

16Trigger-reachable chain: manifest.main -> src/main.js -> src/backends/hub-client.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L29: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L30: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L31: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L40: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L41: "https://r2.deepfetch.de5.net/rootfs/cicy-wsl-latest.tar.gz"; L42: ... L64: } catch (e) { L65: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L66: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

16Trigger-reachable persistence chain: manifest.main -> src/main.js -> src/backends/hub-client.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L29: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L30: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L31: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L40: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L41: "https://r2.deepfetch.de5.net/rootfs/cicy-wsl-latest.tar.gz"; L42: ... L64: } catch (e) { L65: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L66: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

bin/cicy-desktop#virtual:normalized:round1View file

495Trigger-reachable command-output exfiltration chain: scripts.start -> bin/cicy-desktop L495: // A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L496: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L497: // ... L501: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L502: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L503: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L495

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/cicy-desktop#virtual:normalized:round1View on unpkg

scripts/build-homepage.cjsView file

27console.log(`[build-homepage] $ ${cmd} (in ${path.relative(ROOT, cwd) || "."})`); L28: execSync(cmd, { cwd, stdio: "inherit" }); L29: } ... L32: if (!fs.existsSync(path.join(RENDER, "node_modules"))) { L33: run("npm install --no-audit --no-fund", RENDER); L34: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 815 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cicy-desktop@2.1.326 matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.326 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/main.jsView on unpkg

Source & flagged code

17 flagged · loading source

scripts/sync-runtime-deps.cjsView file

13L14: const { execSync } = require("child_process"); L15: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

scripts/r2.mjsView file

46// Windows: npx is npx.cmd, which Node only spawns with shell:true — and then L47: // cmd.exe re-parses the argv, so anything with a space ("CiCy Desktop Setup L48: // 2.1.324.exe") must be quoted or it arrives as several arguments.

High

Shell

Package source references shell execution.

scripts/r2.mjsView on unpkg · L46

17// R2_BUCKET default: cicy-assets-poc L18: // R2_PUBLIC_BASE default: https://r2.deepfetch.de5.net L19: // ... L24: L25: import { spawnSync } from "node:child_process"; L26: import { pathToFileURL } from "node:url"; ... L28: L29: const BUCKET = process.env.R2_BUCKET || "cicy-assets-poc"; L30: const PUBLIC_BASE = (process.env.R2_PUBLIC_BASE || "https://r2.deepfetch.de5.net").replace(/\/$/, ""); ... L37: function die(msg, code = 1) { L38: process.stderr.write(`r2: ${msg}\n`); L39: process.exit(code);

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

scripts/r2.mjsView on unpkg · L17

24L25: import { spawnSync } from "node:child_process"; L26: import { pathToFileURL } from "node:url"; ... L29: const BUCKET = process.env.R2_BUCKET || "cicy-assets-poc"; L30: const PUBLIC_BASE = (process.env.R2_PUBLIC_BASE || "https://r2.deepfetch.de5.net").replace(/\/$/, ""); L31: const ACCOUNT = process.env.R2_ACCOUNT_ID || ""; ... L37: function die(msg, code = 1) { L38: process.stderr.write(`r2: ${msg}\n`); L39: process.exit(code);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/r2.mjsView on unpkg · L24

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/r2.mjsView on unpkg · L17

src/tools/file-tools.jsView file

8L9: const FILES_DIR = path.join(require("os").homedir(), "cicy-files"); L10: ... L100: "file_upload", L101: "上传文件到服务器（base64编码），返回可访问的 URL", L102: z.object({ ... L122: const baseUrl = L123: process.env.CICY_BASE_URL || `http://localhost:${process.env.PORT || 8101}`; L124: const url = `${baseUrl}/files/${uniqueFilename}`;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tools/file-tools.jsView on unpkg · L8

src/sidecar/docker.jsView file

10// locally it's loaded from our R2 bucket (no Docker Hub pull): L11: // https://r2.deepfetch.de5.net/images/cicy-code-latest.tar.gz L12: // ... L14: const log = require("electron-log"); // bootstrap preflight failures must land in main.log L15: const { execFile, execFileSync, spawn } = require("child_process"); L16: const https = require("https"); ... L22: L23: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; L24: // Image tarball on Cloudflare R2 (public bucket). The Aliyun OSS mirror it used ... L67: return new Promise((resolve, reject) => { L68: execFile(dockerBin(), args, { timeout, windowsHide: true }, (err, stdout, stderr) => { L69: if (err) { err.stdout = String(stdout || ""); err.stderr = String(stderr || ""); return reject(err); }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/sidecar/docker.jsView on unpkg · L10

src/sidecar/host-mihomo.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/sidecar/host-mihomo.jsView on unpkg · L20

20L21: const { spawn, execFile } = require("child_process"); L22: const fs = require("fs"); ... L24: const path = require("path"); L25: const https = require("https"); L26: const http = require("http"); ... L30: L31: const VER = (process.env.CICY_MIHOMO_VERSION || "v1.10.4").replace(/^v?/, "v"); L32: const R2_BASE = process.env.CICY_R2_BASE || process.env.CICY_OSS_BASE || "https://r2.deepfetch.de5.net"; ... L44: const VERD = VER.replace(/^v/, ""); L45: const LOCAL_BIN = path.join(os.homedir(), ".local", "bin"); L46: const NEW_BIN = path.join(LOCAL_BIN, `mihomo-${VERD}${EXT}`);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/sidecar/host-mihomo.jsView on unpkg · L20

src/sidecar/colima-docker.jsView file

26L27: const { execFile, spawn } = require("child_process"); L28: const path = require("path"); ... L33: // 专用 Colima profile —— 绝不动用户自己的默认 colima/docker。 L34: const PROFILE = process.env.CICY_COLIMA_PROFILE || "cicy-code"; L35: // Colima 给每个 profile 建一个 docker context,名字是 `colima-<profile>`。所有 ... L64: // Xcode/CLT —— colima/docker 都是预编译 bottle,无编译步骤)。可用环境变量换 CN 镜像。 L65: const BREW_TARBALL = process.env.CICY_BREW_TARBALL || "https://github.[redacted]"; L66: ... L70: execFile("bash", ["-lc", cmd], { timeout, env: shEnv(), maxBuffer: 1 << 26 }, L71: (err, stdout, stderr) => { L72: if (err) { err.stdout = String(stdout || ""); err.stderr = String(stderr || ""); return reject(err); }

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sidecar/colima-docker.jsView on unpkg · L26

src/sidecar/wsl-docker.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

bin/cicy-desktop#virtual:normalized:round1View file

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L495

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/cicy-desktop#virtual:normalized:round1View on unpkg

scripts/build-homepage.cjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 815 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/main.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/main.jsView on unpkg

Source & flagged code

17 flagged

scripts/sync-runtime-deps.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// SPDX-License-Identifier: Apache-2.0

5// Sync optionalDependencies to the LATEST published per-platform cicy-code and

6// cicy-mihomo subpackages, so every cicy-desktop build/publish bundles the

7// newest binaries. Run in CI before install/build (and before `npm publish`).

8//

9// (2026-06-08): Windows no longer ships msys2/tmux — the win sidecar

10// runs the single headless 团队助手 (--helper), so cicy-msys2-* is DROPPED here.

11//

12// Usage: node scripts/sync-runtime-deps.cjs (writes package.json in place)

14const { execSync } = require("child_process");

15const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

16const path = require("path");

18const REGISTRY = process.env.NPM_REGISTRY || "https://registry.npmjs.org";

19const PLATFORMS = ["darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64", "windows-x64", "windows-arm64"];

20const COMPONENTS = ["cicy-code", "cicy-mihomo"]; // NOT cicy-msys2 — win drops it

22function latest(pkg) {

23 // Use execSync (runs through a shell) instead of execFileSync: on Windows npm

24 // is npm.cmd, and Node refuses to spawn .cmd/.bat without a shell (EINVAL) —

25 // execFileSync('npm'|'npm.cmd', …) therefore threw on every call and the whole

26 // script aborted with "resolved nothing" even though the registry was fine.

27 // cmd.exe (win) / sh (unix) resolve `npm` correctly. pkg/REGISTRY are trusted

28 // constants, so the interpolation is safe.

29 try {

30 return execSync(`npm view ${pkg} version --registry=${REGISTRY}`, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;

31 } catch {

32 return null; // not published for this platform (e.g. cicy-code has no windows-arm64)

33 }

scripts/r2.mjsView file

Lines 1-66javascript

1#!/usr/bin/env node

2// scripts/r2.mjs — publish release assets to the Cloudflare R2 bucket.

3//

4// Replaces ossutil across the release workflows: one entry point that works

5// the same from bash (linux/mac) and pwsh (windows), so the upload steps stop

6// carrying three different CLIs.

7//

8// node scripts/r2.mjs put <key> <file> upload (overwrites)

9// node scripts/r2.mjs exists <key> exit 0 if the object is there

10// node scripts/r2.mjs list <prefix> print matching keys, one per line

src/tools/file-tools.jsView file

Lines 1-28javascript

2// SPDX-License-Identifier: Apache-2.0

4const { z } = require("zod");

5const fs = require("fs");

src/sidecar/docker.jsView file

Lines 1-30javascript

2// SPDX-License-Identifier: Apache-2.0

4// Windows sidecar backend: run cicy-code inside a Docker container.

5//

6// Platform split (2026-06): mac/linux start cicy-code locally via `npx

7// cicy-code` (see cicy-code.js); Windows runs it in Docker Desktop instead.

8// The base-env image's entrypoint installs cicy-code from npm at container

9// startup, so the image is version-independent. If the image isn't present

10// locally it's loaded from our R2 bucket (no Docker Hub pull):

src/sidecar/host-mihomo.jsView file

Lines 1-40javascript

2// SPDX-License-Identifier: Apache-2.0

4// Host-side mihomo for the Chrome per-profile proxy.

5//

6// docker-only put mihomo INSIDE the cicy-code container. But the system Chrome

7// runs on the HOST (mac/win/linux), and its per-profile proxy points at

8// 127.0.0.1:2000N — which a container CANNOT reliably serve through colima/WSL

9// port-forwarding (the per-profile listeners bind 127.0.0.1 inside the container;

10// publishing the 20001-32 range through colima/Lima never reached them → Chrome

src/sidecar/colima-docker.jsView file

Lines 6-46javascript

6// macOS 没有 WSL。对应 Windows 端「不装 Docker Desktop GUI、用确定性命令驱动

7// Docker 引擎」的方案,在 Mac 上就是 Colima:一个 Apache-2.0、纯 CLI、无 GUI、

8// 无授权、无 root 的轻量 Linux VM(基于 Lima),里面跑标准 Docker 引擎。Lima 会

9// 把 VM 内监听 127.0.0.1 的端口自动转发到宿主 127.0.0.1,所以 VM 里发布在

10// :8008 的容器,Mac 上 127.0.0.1:8008 直接可达——和 WSL2 的 localhost 转发等价。

11//

12// 与 wsl-docker.js 完全同接口(bootstrap/status/restart/stop/dockerRestart/

13// recreate/update/upgrade/runContainer/readContainerToken),由 sidecar-ipc.js

14// 按平台分发:darwin → 本模块,win32 → wsl-docker.js。

15//

src/sidecar/wsl-docker.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

bin/cicy-desktop#virtual:normalized:round1View file

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L495

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/cicy-desktop#virtual:normalized:round1View on unpkg

scripts/build-homepage.cjsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-homepage.cjsView on unpkg · L27

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 815 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/main.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/main.jsView on unpkg

cicy-desktop@2.1.327

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code