Loading npm security reports…

edgeone@1.6.34: Malicious npm security report (Block) | LPM Firewall

registry / edgeone / 1.6.34

edgeone@1.6.34

Command-line interface for TencentCloud Pages Functions

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Running the edgeone CLI launches a bundled telemetry wrapper. It collects child-process event data and uploads it to Tencent logging hosts on process exit.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A user runs the edgeone command.

Impact

Account or project identifiers, platform details, command event data, and error stacks can leave the local machine without an evident consent control.

Mechanism

Hidden telemetry collection and network upload through the CLI launcher.

Attack narrative

The installed executable is a bundled launcher rather than a thin CLI shim. It spawns the main CLI with IPC, accepts event records from it, adds local network information and exit telemetry, and uploads the batch to hard-coded Tencent log-service endpoints. The child CLI supplies platform details, environment-derived identifiers, command events, and truncated error stacks. This collection occurs whenever the user runs the CLI and is not an API request needed to perform the requested command.

AI rationale

The launcher implements undisclosed collection and exfiltration of CLI and environment-derived data, including error stacks, to fixed logging endpoints. Although there is no install hook, the runtime behavior is a concrete data-exfiltration attack surface.

Evidence

edgeone-bin/edgeone.jsedgeone-dist/cli.js

Network endpoints2

ap-nanjing.cls.tencentcs.comap-singapore.cls.tencentcs.com

Source & flagged code

16 flagged · loading source

edgeone-bin/edgeone.jsView file

7`)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0... L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...

High

Child Process

Package source references child process execution.

edgeone-bin/edgeone.jsView on unpkg · L7

2var _a; L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr... L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([... L5: `).join(` ... L7: `)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0... L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

edgeone-bin/edgeone.jsView on unpkg · L2

2var _a; L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr... L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([... L5: `).join(` ... L7: `)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0... L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

edgeone-bin/edgeone.jsView on unpkg · L2

2Trigger-reachable command-output exfiltration chain: manifest.bin -> edgeone-bin/edgeone.js L2: var _a; L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr... L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([... L5: `).join(` ... L7: `)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0... L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,thi

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

edgeone-bin/edgeone.jsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = edgeone@1.6.29 matchedPath = edgeone-bin/edgeone.js matchedIdentity = npm:ZWRnZW9uZQ:1.6.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

edgeone-bin/edgeone.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 48dcd752ecac19f9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = edgeone@1.6.29 matchedPath = edgeone-bin/edgeone.js matchedIdentity = npm:ZWRnZW9uZQ:1.6.29 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

edgeone-bin/edgeone.jsView on unpkg

2var _a; L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr... L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

edgeone-bin/edgeone.jsView on unpkg · L2

edgeone-dist/pages/dev/runner-worker.jsView file

1Cross-file remote execution chain: edgeone-dist/pages/dev/runner-worker.js spawns edgeone-bin/edgeone.js; helper contains network access plus dynamic code execution. L1: var _a; L2: var YNe=Object.create;var zT=Object.defineProperty;var JNe=Object.getOwnPropertyDescriptor;var XNe=Object.getOwnPropertyNames;var ZNe=Object.getPrototypeOf,QNe=Object.prototype.has... L3: `?(tx++,Jm=0):e?Jm+=e.length:Jm++,e&&(Sk+=e.length),e}var RG={default(){switch(Ks){case" ":case"\v":case"\f":case" ":case"\xA0":case"\uFEFF":case` ... L8: `:case"\u2028":case"\u2029":return cr(),"";case"\r":return cr(),Av()===` L9: `&&cr(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw ru(cr());case void 0:throw ru(cr())}return cr()}function n4e(){let e="",t=Av();if(!Ql.isHex... L10: `+n;ne=J.

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

edgeone-dist/pages/dev/runner-worker.jsView on unpkg · L1

1Detached bundled service listener: edgeone-dist/pages/dev/runner-worker.js launches a Node helper and exposes a broad-bound HTTP listener. L1: var _a; L2: var YNe=Object.create;var zT=Object.defineProperty;var JNe=Object.getOwnPropertyDescriptor;var XNe=Object.getOwnPropertyNames;var ZNe=Object.getPrototypeOf,QNe=Object.prototype.has... L3: `?(tx++,Jm=0):e?Jm+=e.length:Jm++,e&&(Sk+=e.length),e}var RG={default(){switch(Ks){case" ":case"\v":case"\f":case" ":case"\xA0":case"\uFEFF":case` ... L8: `:case"\u2028":case"\u2029":return cr(),"";case"\r":return cr(),Av()===` L9: `&&cr(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw ru(cr());case void 0:throw ru(cr())}return cr()}function n4e(){let e="",t=Av();if(!Ql.isHex... L10: `+n;ne=J.join(ge),le=`{ ... L14: `+n

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

edgeone-dist/pages/observability-python/bootstrap.pyView file

•path = edgeone-dist/pages/observability-python/bootstrap.py kind = build_helper sizeBytes = 5257 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

edgeone-dist/pages/observability-python/bootstrap.pyView on unpkg

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView file

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = high_entropy_blob sizeBytes = 22939 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = compressed_blob sizeBytes = 22939 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 22939 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

edgeone-dist/studio/ui/assets/tea-Slf_ajmf.jsView file

•path = edgeone-dist/studio/ui/assets/tea-Slf_ajmf.js kind = oversized_source_file sizeBytes = 4904963 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

edgeone-dist/studio/ui/assets/tea-Slf_ajmf.jsView on unpkg

edgeone-dist/cli.jsView file

•path = edgeone-dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 10831736 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

edgeone-dist/cli.jsView on unpkg

Source & flagged code

16 flagged

edgeone-bin/edgeone.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2var _a;

3var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnProperty;var p=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Hn=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of Dn(e))!jn.call(t,s)&&s!==r&&jt(t,s,{get:()=>e[s],enumerable:!(n=Bn(e,s))||n.enumerable});return t};var ce=(t,e,r)=>(r=t!=null?Un(Mn(t)):{},Hn(e||!t||!t.__esModule?jt(r,"default",{value:t,enumerable:!0}):r,t));var kt=p(Ht=>{var d=Ht,{Buffer:Oe}=require("buffer"),kn=require ...

4`),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([s]):r[n]=r[n]?r[n]+", "+s:s}}),r}});var yr=p((mi,gr)=>{"use strict";var vr=x();gr.exports=vr.isStandardBrowserEnv()?function(){var e=/(msie|trident)/i.test(navigator.userAgent),r=document.createElement("a"),n;function s(o){var i=o;return e&&(r.setAttribute("href",i),i=r.href),r.setAttribute("href",i),{href:r.href,protocol:r.protocol?r.protocol.replace(/:$/,""):"",host:r.host,search:r.search?r.search.replace(/^\?/,"") ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

edgeone-bin/edgeone.jsView on unpkg · L2

5`).join(`

6`+o),t.push(s+"m+"+Ue.exports.humanize(this.diff)+"\x1B[0m")}else t[0]=Ws()+e+" "+t[0]}function Ws(){return

7`)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=

8`).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,

9

Long lines were clipped for display.

•matchType = normalized_sha256 matchedPackage = edgeone@1.6.29 matchedPath = edgeone-bin/edgeone.js matchedIdentity = npm:ZWRnZW9uZQ:1.6.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

edgeone-bin/edgeone.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 48dcd752ecac19f9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = edgeone@1.6.29 matchedPath = edgeone-bin/edgeone.js matchedIdentity = npm:ZWRnZW9uZQ:1.6.29 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

edgeone-bin/edgeone.jsView on unpkg

edgeone-dist/pages/dev/runner-worker.jsView file

1Cross-file remote execution chain: edgeone-dist/pages/dev/runner-worker.js spawns edgeone-bin/edgeone.js; helper contains network access plus dynamic code execution. L1: var _a; L2: var YNe=Object.create;var zT=Object.defineProperty;var JNe=Object.getOwnPropertyDescriptor;var XNe=Object.getOwnPropertyNames;var ZNe=Object.getPrototypeOf,QNe=Object.prototype.has... L3: `?(tx++,Jm=0):e?Jm+=e.length:Jm++,e&&(Sk+=e.length),e}var RG={default(){switch(Ks){case" ":case"\v":case"\f":case" ":case"\xA0":case"\uFEFF":case` ... L8: `:case"\u2028":case"\u2029":return cr(),"";case"\r":return cr(),Av()===` L9: `&&cr(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw ru(cr());case void 0:throw ru(cr())}return cr()}function n4e(){let e="",t=Av();if(!Ql.isHex... L10: `+n;ne=J.

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

edgeone-dist/pages/dev/runner-worker.jsView on unpkg · L1

1Detached bundled service listener: edgeone-dist/pages/dev/runner-worker.js launches a Node helper and exposes a broad-bound HTTP listener. L1: var _a; L2: var YNe=Object.create;var zT=Object.defineProperty;var JNe=Object.getOwnPropertyDescriptor;var XNe=Object.getOwnPropertyNames;var ZNe=Object.getPrototypeOf,QNe=Object.prototype.has... L3: `?(tx++,Jm=0):e?Jm+=e.length:Jm++,e&&(Sk+=e.length),e}var RG={default(){switch(Ks){case" ":case"\v":case"\f":case" ":case"\xA0":case"\uFEFF":case` ... L8: `:case"\u2028":case"\u2029":return cr(),"";case"\r":return cr(),Av()===` L9: `&&cr(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw ru(cr());case void 0:throw ru(cr())}return cr()}function n4e(){let e="",t=Av();if(!Ql.isHex... L10: `+n;ne=J.join(ge),le=`{ ... L14: `+n

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

edgeone-dist/pages/observability-python/bootstrap.pyView file

•path = edgeone-dist/pages/observability-python/bootstrap.py kind = build_helper sizeBytes = 5257 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

edgeone-dist/pages/observability-python/bootstrap.pyView on unpkg

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView file

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = high_entropy_blob sizeBytes = 22939 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = compressed_blob sizeBytes = 22939 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 22939 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

edgeone-dist/studio/ui/assets/tea-Slf_ajmf.jsView file

•path = edgeone-dist/studio/ui/assets/tea-Slf_ajmf.js kind = oversized_source_file sizeBytes = 4904963 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

edgeone-dist/studio/ui/assets/tea-Slf_ajmf.jsView on unpkg

edgeone-dist/cli.jsView file

•path = edgeone-dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 10831736 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

edgeone-dist/cli.jsView on unpkg