Loading npm security reports…

cicy-desktop@2.1.360: Malicious npm security report (Block) | LPM Firewall

registry / cicy-desktop / 2.1.360

cicy-desktop@2.1.360

CiCy - AI-powered operating system browser

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Running the CLI opens a remotely served homepage with an unrestricted bridge to host command and file tools. A party controlling that homepage can execute commands on the user's machine without a prompt.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user runs cicy-desktop or starts the Electron application.

Impact

Remote code execution and unrestricted local file access under the user account.

Mechanism

Remote homepage content invokes an unguarded IPC bridge that dispatches shell and file tools.

Attack narrative

On normal application startup, the package loads desktop.cicy-ai.com by default. Its homepage preload exposes a raw IPC channel, and the main process dispatches requested tools without an origin or consent check. The tool registry includes exec_shell, which passes supplied commands to child_process.exec. Therefore, a deployment change or compromise of the remote homepage directly yields command execution on every running desktop client. The launcher also downloads an Electron archive from a remote mirror without cryptographic verification.

AI rationale

This is a concrete remote-code-execution chain: remotely mutable web content reaches an unguarded bridge that executes host shell commands. The absence of an npm install hook does not mitigate runtime execution on normal launch.

Evidence

src/backends/homepage-window.jssrc/main.jssrc/tools/exec-tools.jsbin/cicy-desktopsrc/backends/homepage-preload.jsnode_modules/electron/dist~/Downloads

Source & flagged code

29 flagged

scripts/sync-runtime-deps.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// SPDX-License-Identifier: Apache-2.0

5// Sync optionalDependencies to the LATEST published per-platform cicy-code and

6// cicy-mihomo subpackages, so every cicy-desktop build/publish bundles the

7// newest binaries. Run in CI before install/build (and before `npm publish`).

8//

9// (2026-06-08): Windows no longer ships msys2/tmux — the win sidecar

10// runs the single headless 团队助手 (--helper), so cicy-msys2-* is DROPPED here.

11//

12// Usage: node scripts/sync-runtime-deps.cjs (writes package.json in place)

14const { execSync } = require("child_process");

15const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

16const path = require("path");

18const REGISTRY = process.env.NPM_REGISTRY || "https://registry.npmjs.org";

19const PLATFORMS = ["darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64", "windows-x64", "windows-arm64"];

20const COMPONENTS = ["cicy-code", "cicy-mihomo"]; // NOT cicy-msys2 — win drops it

22function latest(pkg) {

23 // Use execSync (runs through a shell) instead of execFileSync: on Windows npm

24 // is npm.cmd, and Node refuses to spawn .cmd/.bat without a shell (EINVAL) —

25 // execFileSync('npm'|'npm.cmd', …) therefore threw on every call and the whole

26 // script aborted with "resolved nothing" even though the registry was fine.

27 // cmd.exe (win) / sh (unix) resolve `npm` correctly. pkg/REGISTRY are trusted

28 // constants, so the interpolation is safe.

29 try {

30 return execSync(`npm view ${pkg} version --registry=${REGISTRY}`, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;

31 } catch {

32 return null; // not published for this platform (e.g. cicy-code has no windows-arm64)

33 }

scripts/r2.mjsView file

Lines 1-66javascript

1#!/usr/bin/env node

2// scripts/r2.mjs — publish release assets to the Cloudflare R2 bucket.

3//

4// Replaces ossutil across the release workflows: one entry point that works

5// the same from bash (linux/mac) and pwsh (windows), so the upload steps stop

6// carrying three different CLIs.

7//

8// node scripts/r2.mjs put <key> <file> upload (overwrites)

9// node scripts/r2.mjs exists <key> exit 0 if the object is there

10// node scripts/r2.mjs list <prefix> print matching keys, one per line

workers/render/src/App.jsxView file

Lines 1502-1542jsx

1502 const t = ((r && r.content) || []).map((c) => c && c.text).join("");

1503 const j

tools/arm-fblogin.jsView file

Lines 1-26javascript

1(() => {

2 const req = process.mainModule && process.mainModule.require;

3 const fs=req('fs'), os=req('os'

src/main.jsView file

Lines 62-102javascript

62 try {

63 if (wc.getType && wc.getType() === "webview") {

64 wc.on("before-input-event", (_ev, input) => {

src/sidecar/host-mihomo.jsView file

Lines 1-40javascript

2// SPDX-License-Identifier: Apache-2.0

4// Host-side mihomo for the Chrome per-profile proxy.

5//

6// docker-only put mihomo INSIDE the cicy-code container. But the system Chrome

7// runs on the HOST (mac/win/linux), and its per-profile proxy points at

8// 127.0.0.1:2000N — which a container CANNOT reliably serve through colima/WSL

9// port-forwarding (the per-profile listeners bind 127.0.0.1 inside the container;

10// publishing the 20001-32 range through colima/Lima never reached them → Chrome

src/sidecar/colima-docker.jsView file

26L27: const { execFile, spawn } = require("child_process"); L28: const path = require("path"); ... L33: // 专用 Colima profile —— 绝不动用户自己的默认 colima/docker。 L34: const PROFILE = process.env.CICY_COLIMA_PROFILE || "cicy-code"; L35: // Colima 给每个 profile 建一个 docker context,名字是 `colima-<profile>`。所有 ... L64: // Xcode/CLT —— colima/docker 都是预编译 bottle,无编译步骤)。可用环境变量换 CN 镜像。 L65: const BREW_TARBALL = process.env.CICY_BREW_TARBALL || "https://github.[redacted]"; L66: ... L70: execFile("bash", ["-lc", cmd], { timeout, env: shEnv(), maxBuffer: 1 << 26 }, L71: (err, stdout, stderr) => { L72: if (err) { err.stdout = String(stdout || ""); err.stderr = String(stderr || ""); return reject(err); }

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sidecar/colima-docker.jsView on unpkg · L26

src/sidecar/wsl-docker.jsView file

16Trigger-reachable chain: manifest.main -> src/main.js -> src/backends/hub-client.js -> src/sidecar/wsl-docker.js L16: L17: const { execFile, execFileSync, spawn } = require("child_process"); L18: const path = require("path"); ... L29: // Dedicated distro name — NEVER reuse/clobber a user's own "Ubuntu" distro. L30: const DISTRO = process.env.CICY_WSL_DISTRO || "cicy-code-wsl"; L31: const IMAGE = process.env.CICY_DOCKER_IMAGE || "cicybot/cicy-code:latest"; ... L40: const ROOTFS_URL = process.env.CICY_WSL_ROOTFS_URL || L41: "https://r2.deepfetch.de5.net/rootfs/cicy-wsl-latest.tar.gz"; L42: ... L64: } catch (e) { L65: log.info(`[wsl-docker] NVIDIA GPU unavailable for ${cacheKey}: ${String(e.stderr || e.message || "").trim().slice(-300)}`); L66: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/sidecar/wsl-docker.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/wsl-docker.jsView on unpkg

bin/cicy-desktop#virtual:normalized:round1View file

495Trigger-reachable command-output exfiltration chain: scripts.start -> bin/cicy-desktop L495: // A .cmd is icon-less; a proper .lnk with the CiCy icon is written via a L496: // throwaway PowerShell script (WScript.Shell CreateShortcut + IconLocation). L497: // ... L501: $s.Arguments = "/c set PATH=${nodeDir};%APPDATA%\\npm;%PATH%&& cicy-desktop" L502: $s.IconLocation = "${ico.replace(/"/g, "''")}"\n$s.Save()\n`);\n try {\n execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File \"${ps}\"`, { stdio: \"ignore\" });\n ... L503: // (https://desktop.cicy-ai.com/) as the first window. The cicy-code

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L495

34L35: // Resolve a globally-installed electron (`npm i -g electron`), so the ~200MB L36: // binary is downloaded once and SHARED across cicy tools / desktop versions ... L42: try { L43: const prefix = execSync("npm prefix -g", { stdio: ["ignore", "pipe", "ignore"] }) L44: .toString().trim();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L34

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 815 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/app-updater.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/app-updater.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app-updater.jsView on unpkg

src/backends/local-teams.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/backends/local-teams.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/local-teams.jsView on unpkg

src/backends/window-manager.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/backends/window-manager.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/window-manager.jsView on unpkg

src/cloud/cloud-client.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/cloud/cloud-client.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cloud/cloud-client.jsView on unpkg

src/main-old.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/main-old.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main-old.jsView on unpkg

src/sidecar/docker.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/sidecar/docker.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/docker.jsView on unpkg

src/tools/exec-tools.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/tools/exec-tools.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/exec-tools.jsView on unpkg

src/tools/system-tools.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/tools/system-tools.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/system-tools.jsView on unpkg

bin/cicy-desktopView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = bin/cicy-desktop matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cicy-desktopView on unpkg

src/backends/ipc.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/backends/ipc.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/ipc.jsView on unpkg

src/sidecar/cicy-code.jsView file

•matchType = normalized_sha256 matchedPackage = cicy-desktop@2.1.359 matchedPath = src/sidecar/cicy-code.js matchedIdentity = npm:Y2ljeS1kZXNrdG9w:2.1.359 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/cicy-code.jsView on unpkg

Source & flagged code

29 flagged · loading source

scripts/sync-runtime-deps.cjsView file

13L14: const { execSync } = require("child_process"); L15: const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

scripts/r2.mjsView file

46// Windows: npx is npx.cmd, which Node only spawns with shell:true — and then L47: // cmd.exe re-parses the argv, so anything with a space ("CiCy Desktop Setup L48: // 2.1.324.exe") must be quoted or it arrives as several arguments.

High

Shell

Package source references shell execution.

scripts/r2.mjsView on unpkg · L46

17// R2_BUCKET default: cicy-assets-poc L18: // R2_PUBLIC_BASE default: https://r2.deepfetch.de5.net L19: // ... L24: L25: import { spawnSync } from "node:child_process"; L26: import { pathToFileURL } from "node:url"; ... L28: L29: const BUCKET = process.env.R2_BUCKET || "cicy-assets-poc"; L30: const PUBLIC_BASE = (process.env.R2_PUBLIC_BASE || "https://r2.deepfetch.de5.net").replace(/\/$/, ""); ... L37: function die(msg, code = 1) { L38: process.stderr.write(`r2: ${msg}\n`); L39: process.exit(code);

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

scripts/r2.mjsView on unpkg · L17

24L25: import { spawnSync } from "node:child_process"; L26: import { pathToFileURL } from "node:url"; ... L29: const BUCKET = process.env.R2_BUCKET || "cicy-assets-poc"; L30: const PUBLIC_BASE = (process.env.R2_PUBLIC_BASE || "https://r2.deepfetch.de5.net").replace(/\/$/, ""); L31: const ACCOUNT = process.env.R2_ACCOUNT_ID || ""; ... L37: function die(msg, code = 1) { L38: process.stderr.write(`r2: ${msg}\n`); L39: process.exit(code);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/r2.mjsView on unpkg · L24

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/r2.mjsView on unpkg · L17

workers/render/src/App.jsxView file

1522// eslint-disable-next-line no-new-func L1523: return await new Function(`return (async()=>{${f.js}})()`)(); L1524: }

High

Eval

Package source references dynamic code evaluation.

workers/render/src/App.jsxView on unpkg · L1522

tools/arm-fblogin.jsView file

6if(!el||!el.ipcMain) return {ok:false,err:'no electron.ipcMain'}; L7: function totp(secret){const alph='[redacted]';let b='';for(const ch of String(secret||'').toUpperCase()){const v=alph.indexOf(ch);if(v>=0)b+=v.toString(2).pad... L8: async function fbLogin(idx){ L9: let cred=null; try{const d=JSON.parse(fs.readFileSync(path.join(os.homedir(),'cicy-ai','electron',`account-${idx}.json`),'utf8'));const fb=(d.logins||[]).find(l=>String(l.name||'')... L10: if(!cred||!cred.email||!cred.pass) return {ok:false,err:'no cred'}; ... L14: const ev=(c)=>wc.executeJavaScript(c,true); L15: const fill=await ev(`(()=>{function s(el,v){const p=Object.getPrototypeOf(el),d=Object.getOwnPropertyDescriptor(p,'value').set;d.call(el,v);el.dispatchEvent(new Event('input',{bubb... L16: if(!fill.ok) return {ok

Low

Weak Crypto

Package source references weak cryptographic algorithms.

tools/arm-fblogin.jsView on unpkg · L6

src/main.jsView file

82Trigger-reachable persistence chain: manifest.main -> src/main.js L82: electronApp.commandLine.appendSwitch("ignore-certificate-errors"); L83: // Allow CDP WebSocket connections from any origin so we can drive Page.reload L84: // remotely (HMR-fallback when CSS / a renderer-side change needs a hard refresh). ... L86: electronApp.commandLine.appendSwitch("remote-allow-origins", "*"); L87: if (process.platform === "linux") { L88: process.env["ELECTRON_DISABLE_SECURITY_WARNINGS"] = "true"; L89: // electronApp.commandLine.appendSwitch("disable-setuid-sandbox"); ... L243: try { L244: wc.send(channel, payload); L245: } catch {} ... L448: res.setHeader("WWW-Authenticate", 'Basic realm="CiCy Desktop"'); L449: return res.status(401).json({ error: "Unauthorized" });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/main.jsView on unpkg · L82

82electronApp.commandLine.appendSwitch("ignore-certificate-errors"); L83: // Allow CDP WebSocket connections from any origin so we can drive Page.reload L84: // remotely (HMR-fallback when CSS / a renderer-side change needs a hard refresh). ... L86: electronApp.commandLine.appendSwitch("remote-allow-origins", "*"); L87: if (process.platform === "linux") { L88: process.env["ELECTRON_DISABLE_SECURITY_WARNINGS"] = "true"; L89: // electronApp.commandLine.appendSwitch("disable-setuid-sandbox"); ... L243: try { L244: wc.send(channel, payload); L245: } catch {} ... L448: res.setHeader("WWW-Authenticate", 'Basic realm="CiCy Desktop"'); L449: return res.status(401).json({ error: "Unauthorized" });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/main.jsView on unpkg · L82

src/sidecar/host-mihomo.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

src/sidecar/host-mihomo.jsView on unpkg · L20

20L21: const { spawn, execFile } = require("child_process"); L22: const fs = require("fs"); ... L24: const path = require("path"); L25: const https = require("https"); L26: const http = require("http"); ... L30: L31: const VER = (process.env.CICY_MIHOMO_VERSION || "v1.10.4").replace(/^v?/, "v"); L32: const R2_BASE = process.env.CICY_R2_BASE || process.env.CICY_OSS_BASE || "https://r2.deepfetch.de5.net"; ... L44: const VERD = VER.replace(/^v/, ""); L45: const LOCAL_BIN = path.join(os.homedir(), ".local", "bin"); L46: const NEW_BIN = path.join(LOCAL_BIN, `mihomo-${VERD}${EXT}`);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/sidecar/host-mihomo.jsView on unpkg · L20

src/sidecar/colima-docker.jsView file

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sidecar/colima-docker.jsView on unpkg · L26

src/sidecar/wsl-docker.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/wsl-docker.jsView on unpkg

bin/cicy-desktop#virtual:normalized:round1View file

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L495

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L34

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 815 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/app-updater.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app-updater.jsView on unpkg

src/backends/local-teams.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/local-teams.jsView on unpkg

src/backends/window-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/window-manager.jsView on unpkg

src/cloud/cloud-client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cloud/cloud-client.jsView on unpkg

src/main-old.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main-old.jsView on unpkg

src/sidecar/docker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/docker.jsView on unpkg

src/tools/exec-tools.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/exec-tools.jsView on unpkg

src/tools/system-tools.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/system-tools.jsView on unpkg

bin/cicy-desktopView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cicy-desktopView on unpkg

src/backends/ipc.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/ipc.jsView on unpkg

src/sidecar/cicy-code.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/cicy-code.jsView on unpkg

Source & flagged code

29 flagged

scripts/sync-runtime-deps.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// SPDX-License-Identifier: Apache-2.0

5// Sync optionalDependencies to the LATEST published per-platform cicy-code and

6// cicy-mihomo subpackages, so every cicy-desktop build/publish bundles the

7// newest binaries. Run in CI before install/build (and before `npm publish`).

8//

9// (2026-06-08): Windows no longer ships msys2/tmux — the win sidecar

10// runs the single headless 团队助手 (--helper), so cicy-msys2-* is DROPPED here.

11//

12// Usage: node scripts/sync-runtime-deps.cjs (writes package.json in place)

14const { execSync } = require("child_process");

15const fs = require("fs");

High

Child Process

Package source references child process execution.

scripts/sync-runtime-deps.cjsView on unpkg · L13

16const path = require("path");

18const REGISTRY = process.env.NPM_REGISTRY || "https://registry.npmjs.org";

19const PLATFORMS = ["darwin-x64", "darwin-arm64", "linux-x64", "linux-arm64", "windows-x64", "windows-arm64"];

20const COMPONENTS = ["cicy-code", "cicy-mihomo"]; // NOT cicy-msys2 — win drops it

22function latest(pkg) {

23 // Use execSync (runs through a shell) instead of execFileSync: on Windows npm

24 // is npm.cmd, and Node refuses to spawn .cmd/.bat without a shell (EINVAL) —

25 // execFileSync('npm'|'npm.cmd', …) therefore threw on every call and the whole

26 // script aborted with "resolved nothing" even though the registry was fine.

27 // cmd.exe (win) / sh (unix) resolve `npm` correctly. pkg/REGISTRY are trusted

28 // constants, so the interpolation is safe.

29 try {

30 return execSync(`npm view ${pkg} version --registry=${REGISTRY}`, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;

31 } catch {

32 return null; // not published for this platform (e.g. cicy-code has no windows-arm64)

33 }

scripts/r2.mjsView file

Lines 1-66javascript

1#!/usr/bin/env node

2// scripts/r2.mjs — publish release assets to the Cloudflare R2 bucket.

3//

4// Replaces ossutil across the release workflows: one entry point that works

5// the same from bash (linux/mac) and pwsh (windows), so the upload steps stop

6// carrying three different CLIs.

7//

8// node scripts/r2.mjs put <key> <file> upload (overwrites)

9// node scripts/r2.mjs exists <key> exit 0 if the object is there

10// node scripts/r2.mjs list <prefix> print matching keys, one per line

workers/render/src/App.jsxView file

Lines 1502-1542jsx

1502 const t = ((r && r.content) || []).map((c) => c && c.text).join("");

1503 const j

tools/arm-fblogin.jsView file

Lines 1-26javascript

1(() => {

2 const req = process.mainModule && process.mainModule.require;

3 const fs=req('fs'), os=req('os'

src/main.jsView file

Lines 62-102javascript

62 try {

63 if (wc.getType && wc.getType() === "webview") {

64 wc.on("before-input-event", (_ev, input) => {

src/sidecar/host-mihomo.jsView file

Lines 1-40javascript

2// SPDX-License-Identifier: Apache-2.0

4// Host-side mihomo for the Chrome per-profile proxy.

5//

6// docker-only put mihomo INSIDE the cicy-code container. But the system Chrome

7// runs on the HOST (mac/win/linux), and its per-profile proxy points at

8// 127.0.0.1:2000N — which a container CANNOT reliably serve through colima/WSL

9// port-forwarding (the per-profile listeners bind 127.0.0.1 inside the container;

10// publishing the 20001-32 range through colima/Lima never reached them → Chrome

src/sidecar/colima-docker.jsView file

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sidecar/colima-docker.jsView on unpkg · L26

src/sidecar/wsl-docker.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sidecar/wsl-docker.jsView on unpkg · L16

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/wsl-docker.jsView on unpkg

bin/cicy-desktop#virtual:normalized:round1View file

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L495

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cicy-desktop#virtual:normalized:round1View on unpkg · L34

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

bin/preinstall.shView file

•path = bin/preinstall.sh kind = build_helper sizeBytes = 815 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/preinstall.shView on unpkg

src/app-updater.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app-updater.jsView on unpkg

src/backends/local-teams.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/local-teams.jsView on unpkg

src/backends/window-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/window-manager.jsView on unpkg

src/cloud/cloud-client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cloud/cloud-client.jsView on unpkg

src/main-old.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/main-old.jsView on unpkg

src/sidecar/docker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/docker.jsView on unpkg

src/tools/exec-tools.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/exec-tools.jsView on unpkg

src/tools/system-tools.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/tools/system-tools.jsView on unpkg

bin/cicy-desktopView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cicy-desktopView on unpkg

src/backends/ipc.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/backends/ipc.jsView on unpkg

src/sidecar/cicy-code.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/cicy-code.jsView on unpkg

cicy-desktop@2.1.360

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code