code-i18n-agent@0.1.6
智能体：自动将代码项目国际化的扫描-分类-提取-翻译-替换-验证管线（不限于 ERP，适配 Vue/React/TS/JS/HTML）
AI Security Review
scanned 2d ago · by lpm-firewall-aiImporting the declared main entry runs the full workflow, and the CLI automatically uses an available OpenAI key without requiring the documented --llm opt-in. This can send translation requests and incur charges merely from importing the package, so it meets the rule for automatic use of a user's key.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer imports the package through its declared main entry, dist/cli.js.
Impact
Unexpected API usage and charges, with project translation text sent for processing. The workflow also writes state and locale resource files before asking to replace source files.
Mechanism
The CLI runs unconditionally, defaults to the full run workflow, and loads an OpenAI API key from the environment without requiring --llm. Translation requests use that key.
Attack narrative
The declared package main points to a CLI that calls main() during module evaluation. With no command-line arguments it runs the full workflow in the current directory, automatically loads OPENAI_API_KEY or I18N_LLM_API_KEY, and sends translation requests to the configured LLM endpoint. Importing the package can therefore use the consumer's key and incur API charges without an explicit translation command.
AI rationale
Importing the declared main entry runs the full workflow, and the CLI automatically uses an available OpenAI key without requiring the documented --llm opt-in. This can send translation requests and incur charges merely from importing the package, so it meets the rule for automatic use of a user's key.
Evidence
package.jsondist/cli.jsdist/config.jsdist/llm/client.jsdist/agent/pipeline.js.i18n-agent/state.jsonsrc/locales/zh-CN.jsonsrc/locales/en-US.jsonsrc/locales/keysMeta.json
Network endpoints1
api.openai.com
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json maps the package main entry to dist/cli.js.
- The CLI defaults to the full run command and invokes main() unconditionally, so importing the package starts the workflow in the current directory.
- The CLI loads an OpenAI key from the environment even when --llm was not provided.
- The LLM client sends a bearer key and request body to the configured endpoint, which defaults to api.openai.com.
- The default workflow includes translation through the LLM client, creating unrequested API usage and possible charges on import.
Evidence against
- The package describes itself as an i18n CLI, and translation is within its stated purpose.
- The README presents --llm as the way to enable real LLM translation, though the CLI also activates it when an API key is present.
- The package has no preinstall, install, or postinstall script; its prepublishOnly script is for building and tests.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggeddist/mcp-server.jsView file
54const readline = __importStar(require("readline"));
L55: const cp = __importStar(require("child_process"));
L56: const path = __importStar(require("path"));
High
Child Process
Package source references child process execution.
dist/mcp-server.jsView on unpkg · L5454Cross-file remote execution chain: dist/mcp-server.js spawns dist/config.js; helper contains network access plus dynamic code execution.
L54: const readline = __importStar(require("readline"));
L55: const cp = __importStar(require("child_process"));
L56: const path = __importStar(require("path"));
...
L171: // 每行一个 JSON，行尾必须有 \n（MCP stdio 帧分隔）
L172: process.stdout.write(JSON.stringify(msg) + '\n');
L173: }
...
L191: return new Promise((resolve) => {
L192: const cliPath = path.join(__dirname, 'cli.js');
L193: const child = cp.spawn(process.execPath, [cliPath, ...args], {
L194: cwd: process.cwd(),
L195: env: process.env,
L196: windowsHide: true
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/mcp-server.jsView on unpkg · L54package.jsonView file
Findings
1 Critical4 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/config.js
HighChild Processdist/mcp-server.js
HighCross File Remote Execution Contextdist/mcp-server.js
HighSemantic Analysis Limitedpackage.json
HighAi Review Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to code-i18n-agent@0.1.6.
See all versions of code-i18n-agent for other recorded verdicts.
- Avoid installing code-i18n-agent@0.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.