registry / coze-coding-dev-sdk / 0.7.26

coze-coding-dev-sdk@0.7.26

⚠ Under review

Coze Coding Dev SDK - 优雅的多功能 AI SDK，支持图片生成、视频生成、语音合成、语音识别、大语言模型和联网搜索

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 3.55 MB of source, external domains: 169.254.169.254, 169.254.170.2, a.co, docs.aws.amazon.com, dotenvx.com, github.com, portal.sso, portal.sso-fips, react-native.canny.io, s3-fips.dualstack, s3-fips.dualstack.us-east-1, s3-fips.us-east-1, s3.amazonaws.com, s3.dualstack, s3.dualstack.us-east-1, s3express-control-fips.dualstack, s3express-control.dualstack, sts.amazonaws.com, www.w3.org

Source & flagged code

9 flagged

dist/esm/131.mjsView file

High

Child Process

Package source references child process execution.

dist/esm/131.mjsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/131.mjsView on unpkg · L1

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/esm/131.mjs: let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... `;await n.execute(sql_sql`CREATE SCHEMA IF NOT EXISTS ${sql_sql.identifier(a)}`),await n.execute(r);let o=(await n.all(sql_sql`select id, hash, created_at from ${sql_sql.identifier... `;for(let n of F(`python3 -c '${e.replace(/'/g,"'\"'\"'")}'`,{encoding:"utf-8",timeout:1e4,stdio:["pipe","pipe","pipe"]}).trim().split("\n")){if(n.startsWith("#"))continue;let e=n.... `;try{let e;ty.writeFileSync(u,s),i&&console.log("Introspecting database schema...");let t=`np

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/esm/131.mjsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: `)}finally{t&&eY.default.existsSync(t)&&eY.default.unlinkSync(t),eY.default.rmdirSync(a)}}class e6{static DEFAULT_MODEL="doubao-seedream-5-0-260128";static DEFAULT_SIZE="2K";static... L3: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,ia),i&&(this.cause=i)}}class ir extends it{static [nd]="TransactionRollbackError";constructor(){... L4: CREATE TABLE IF NOT EXISTS ${sql_sql.identifier(a)}.${sql_sql.identifier(t)} ( ... L69: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html L70: or increase socketAcquisitionWarning

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/131.mjsView on unpkg · L1

dist/cjs/cli/index.jsView file

1Cross-file remote execution chain: dist/cjs/cli/index.js spawns dist/cjs/index.js; helper contains network access plus dynamic code execution. L1: const __rslib_import_meta_url__="u"<typeof document?new(require("url".replace("",""))).URL("file:"+__filename).href:document.currentScript&&document.currentScript.src||new URL("mai... L2: no longer support Node.js ${e} in January 2026. ... L6: L7: More information can be found at: https://a.co/c895JFp`))}},"./node_modules/@aws-sdk/core/dist-[redacted].js"(e,t,n){"use strict";function setCredent... L8: The expected part count is based on the byte-count of the input.params.Body, ... L11: to input.params.ContentLength in bytes. L12: `);this.uploadedParts.sort((e,t)=>e.PartNumber-t.PartNumber);let a={...this.params,Body:void 0,UploadId:this.uploadI

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cjs/cli/index.jsView on unpkg · L1

dist/cjs/index.jsView file

11Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cjs/index.js L11: to input.params.ContentLength in bytes. L12: `);this.uploadedParts.sort((e,i)=>e.PartNumber-i.PartNumber);let r={...this.params,Body:void 0,UploadId:this.uploadId,MultipartUpload:{Parts:this.uploadedParts}};e=await this.clien... L13: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L22: ${i} L23: ${(0,r.n)(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let i=[];for(let t of e.split("/"))t?.length!==0&&"."!==t&&(".."===t?i.pop():i.push(t));let t=`${e?.startsWith("/")... L24: `)}finally{n&&a().existsSync(n)&&a().unlinkSync(n),a().rmdirSync(r)}}},"./src/core/runtime-resource-cache.ts"(e,i,t){"use strict";t.d(i,{H:()=>resolveRuntimeResou

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cjs/index.jsView on unpkg · L11

45}); L46: `;try{let e;g.writeFileSync(l,d),t&&console.log("Introspecting database schema...");let n=`npx drizzle-kit introspect --config=${l}`;t&&console.log(`Running: ${n}`);try{e=(0,o.exec... L47: ${e||i||t.message}`)}if(e&&(e.includes("error:")||e.includes("Error:")))throw Error(`drizzle-kit introspect failed:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cjs/index.jsView on unpkg · L45

dist/esm/cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = coze-coding-dev-sdk@0.7.25 matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.25 similarity = 0.976 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/esm/cli/index.mjsView on unpkg

Source & flagged code

9 flagged · loading source

coze-coding-dev-sdk@0.7.26

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code