Loading npm security reports…

edgeone@1.6.31-2: Suspicious npm security report (Warn) | LPM Firewall

registry / edgeone / 1.6.31-2

edgeone@1.6.31-2

Command-line interface for TencentCloud Pages Functions

AI Security Review

scanned 23h ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The CLI sends telemetry only after a user runs the command, and the package has no install-time hook.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the edgeone command.

Impact

Run metadata may be sent to the package's logging service; no credential harvesting or automatic installation-time action was confirmed.

Mechanism

User-invoked CLI telemetry upload.

Rationale

The package has user-invoked telemetry, bundled CLI code, and a Python wheel, but source inspection found no automatic install trigger or concrete malicious behavior. The static signals are consistent with a platform CLI and its shipped SDK artifact.

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for warning

The user-invoked CLI queues telemetry and uploads it to a Tencent logging host.
The package contains a compressed Python wheel artifact.
The manifest declares a dependency named crypto, matching a Node built-in module.

Evidence against

There is no preinstall, install, or postinstall lifecycle hook.
Telemetry is activated by running the CLI, not by package installation.

Source & flagged code

12 flagged · loading source

edgeone-bin/edgeone.jsView file

7`)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0... L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...

High

Child Process

Package source references child process execution.

edgeone-bin/edgeone.jsView on unpkg · L7

2var _a; L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr... L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([... L5: `).join(` ... L7: `)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0... L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

edgeone-bin/edgeone.jsView on unpkg · L2

2var _a; L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr... L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([... L5: `).join(` ... L7: `)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0... L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

edgeone-bin/edgeone.jsView on unpkg · L2

2Trigger-reachable command-output exfiltration chain: manifest.bin -> edgeone-bin/edgeone.js L2: var _a; L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr... L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([... L5: `).join(` ... L7: `)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0... L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,thi

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

edgeone-bin/edgeone.jsView on unpkg · L2

2var _a; L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr... L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

edgeone-bin/edgeone.jsView on unpkg · L2

edgeone-dist/pages/observability-python/bootstrap.pyView file

•path = edgeone-dist/pages/observability-python/bootstrap.py kind = build_helper sizeBytes = 5257 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

edgeone-dist/pages/observability-python/bootstrap.pyView on unpkg

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView file

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = high_entropy_blob sizeBytes = 22939 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = compressed_blob sizeBytes = 22939 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 22939 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

edgeone-dist/studio/ui/assets/tea-Slf_ajmf.jsView file

•path = edgeone-dist/studio/ui/assets/tea-Slf_ajmf.js kind = oversized_source_file sizeBytes = 4904963 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

edgeone-dist/studio/ui/assets/tea-Slf_ajmf.jsView on unpkg

edgeone-dist/cli.jsView file

•path = edgeone-dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 9242744 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

edgeone-dist/cli.jsView on unpkg

package.jsonView file

•Runtime dependency names matching Node built-ins: crypto

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg