edgeone@1.6.32
Command-line interface for TencentCloud Pages Functions
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes undisclosed automatic telemetry with identifiable local-network and error data, but does not establish install-time execution, credential harvesting, remote payload execution, or destructive behavior. This is a real data-egress risk, not sufficient evidence of malware.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user runs the edgeone command.
Impact
Command and error details, plus a local network address, may leave the machine without a telemetry opt-in.
Mechanism
Automatic CLI telemetry collection and network posting.
AI rationale
The source establishes undisclosed automatic telemetry with identifiable local-network and error data, but does not establish install-time execution, credential harvesting, remote payload execution, or destructive behavior. This is a real data-egress risk, not sufficient evidence of malware.
Evidence
edgeone-bin/edgeone.jsedgeone-dist/cli.js
Network endpoints2
ap-nanjing.cls.tencentcs.comap-singapore.cls.tencentcs.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The launcher automatically sends CLI event telemetry to hard-coded Tencent log hosts.
- Telemetry includes the machine's local network address and forwarded CLI event data.
- CLI events can include truncated error messages and stacks.
Evidence against
- The manifest has no install, preinstall, or postinstall hook; its only publish hook runs before publishing.
- The package is an explicit CLI, and the child process launches its packaged CLI entrypoint.
- The flagged worker's dynamic import fallback is a transparent development-runtime compatibility mechanism.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
16 flagged · loading sourceedgeone-bin/edgeone.jsView file
7`)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0...
L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...
High
Child Process
Package source references child process execution.
edgeone-bin/edgeone.jsView on unpkg · L72var _a;
L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr...
L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([...
L5: `).join(`
...
L7: `)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0...
L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
edgeone-bin/edgeone.jsView on unpkg · L2Findings
11 High8 Medium7 Low
HighChild Processedgeone-bin/edgeone.js
HighShell
HighSame File Env Network Executionedgeone-bin/edgeone.js
HighCommand Output Exfiltrationedgeone-bin/edgeone.js
HighCross File Remote Execution Contextedgeone-dist/pages/dev/runner-worker.js
HighSpawned Bundled Service Listeneredgeone-dist/pages/dev/runner-worker.js
HighTrigger Reachable Command Output Exfiltrationedgeone-bin/edgeone.js
HighShips High Entropy Bloblibs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl
HighKnown Malware Source Similarityedgeone-bin/edgeone.js
HighKnown Malware Source Similarityedgeone-dist/pages/dev/runner-worker.js
HighKnown Malware Source Fingerprint Signature
Affected versions and remediation
This report applies to edgeone@1.6.32.
See all versions of edgeone for other recorded verdicts.
- Review the evidence and your use of edgeone@1.6.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.