registry / coze-coding-dev-sdk / 0.7.27

coze-coding-dev-sdk@0.7.27

⚠ Under review

Coze Coding Dev SDK - 优雅的多功能 AI SDK，支持图片生成、视频生成、语音合成、语音识别、大语言模型和联网搜索

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 3.55 MB of source, external domains: 169.254.169.254, 169.254.170.2, a.co, docs.aws.amazon.com, dotenvx.com, github.com, portal.sso, portal.sso-fips, react-native.canny.io, s3-fips.dualstack, s3-fips.dualstack.us-east-1, s3-fips.us-east-1, s3.amazonaws.com, s3.dualstack, s3.dualstack.us-east-1, s3express-control-fips.dualstack, s3express-control.dualstack, sts.amazonaws.com, www.w3.org

Source & flagged code

8 flagged

dist/esm/131.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = coze-coding-dev-sdk@0.7.25 matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.25 similarity = 0.927 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/esm/131.mjsView on unpkg

High

Child Process

Package source references child process execution.

dist/esm/131.mjsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/131.mjsView on unpkg · L1

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/esm/131.mjs: let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... `;await n.execute(sql_sql`CREATE SCHEMA IF NOT EXISTS ${sql_sql.identifier(a)}`),await n.execute(r);let o=(await n.all(sql_sql`select id, hash, created_at from ${sql_sql.identifier... `;for(let n of F(`python3 -c '${e.replace(/'/g,"'\"'\"'")}'`,{encoding:"utf-8",timeout:1e4,stdio:["pipe","pipe","pipe"]}).trim().split("\n")){if(n.startsWith("#"))continue;let e=n.... `;try{let e;ty.writeFileSync(u,s),i&&console.log("Introspecting database schema...");let t=`np

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/esm/131.mjsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,ia),i&&(this.cause=i)}}class ir extends it{static [nd]="TransactionRollbackError";constructor(){... L3: CREATE TABLE IF NOT EXISTS ${sql_sql.identifier(a)}.${sql_sql.identifier(t)} ( ... L68: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html L69: or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler config.`),Date.now()}return n}constructor(e){this.configProvider=new Promise((n,i)=>{"function"==typeof ... L70: `),l.push(e),l.push("\r\n")}),e.on(

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/131.mjsView on unpkg · L1

dist/cjs/index.jsView file

11Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cjs/index.js L11: to input.params.ContentLength in bytes. L12: `);this.uploadedParts.sort((e,i)=>e.PartNumber-i.PartNumber);let r={...this.params,Body:void 0,UploadId:this.uploadId,MultipartUpload:{Parts:this.uploadedParts}};e=await this.clien... L13: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L22: ${i} L23: ${(0,r.n)(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let i=[];for(let t of e.split("/"))t?.length!==0&&"."!==t&&(".."===t?i.pop():i.push(t));let t=`${e?.startsWith("/")... L24: import os

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cjs/index.jsView on unpkg · L11

44}); L45: `;try{let e;g.writeFileSync(l,d),t&&console.log("Introspecting database schema...");let n=`npx drizzle-kit introspect --config=${l}`;t&&console.log(`Running: ${n}`);try{e=(0,o.exec... L46: ${e||i||t.message}`)}if(e&&(e.includes("error:")||e.includes("Error:")))throw Error(`drizzle-kit introspect failed:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cjs/index.jsView on unpkg · L44

Source & flagged code

8 flagged · loading source

coze-coding-dev-sdk@0.7.27

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code