registry / edgeone / 1.6.37

edgeone@1.6.37

Command-line interface for TencentCloud Pages Functions

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The high-signal files contain a bundled CLI, a development worker, and a standard compressed Python wheel, but source inspection found no automatic install execution or concrete malicious chain. The static similarity signal is not substantiated by the inspected behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs the edgeone CLI.

Impact

No unconsented installation-time mutation, exfiltration, or persistence was found.

Mechanism

CLI launch, project build tooling, and package-aligned telemetry.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a CLI executable and has only a prepublish build hook.
The CLI launcher is minified and reports runtime telemetry to Tencent log endpoints when the user runs the CLI.
The development worker uses dynamic import for optional runtime loading.
A compressed Python wheel is bundled, creating a non-source artifact to inspect.

Evidence against

No preinstall, install, postinstall, or prepare hook runs on consumer installation.
No self-dependency or nested lifecycle chain is declared.
The launcher starts the packaged CLI with the user's arguments; no import-time payload was found.
The worker's dynamic import supports runtime modules, not a remote payload.
No credential harvesting, foreign agent configuration mutation, or destructive install behavior was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

14 flagged

edgeone-bin/edgeone.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2var _a;

3var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnProperty;var p=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Hn=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of Dn(e))!jn.call(t,s)&&s!==r&&jt(t,s,{get:()=>e[s],enumerable:!(n=Bn(e,s))||n.enumerable});return t};var ce=(t,e,r)=>(r=t!=null?Un(Mn(t)):{},Hn(e||!t||!t.__esModule?jt(r,"default",{value:t,enumerable:!0}):r,t));var kt=p(Ht=>{var d=Ht,{Buffer:Oe}=require("buffer"),kn=require ...

4`),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([s]):r[n]=r[n]?r[n]+", "+s:s}}),r}});var yr=p((mi,gr)=>{"use strict";var vr=x();gr.exports=vr.isStandardBrowserEnv()?function(){var e=/(msie|trident)/i.test(navigator.userAgent),r=document.createElement("a"),n;function s(o){var i=o;return e&&(r.setAttribute("href",i),i=r.href),r.setAttribute("href",i),{href:r.href,protocol:r.protocol?r.protocol.replace(/:$/,""):"",host:r.host,search:r.search?r.search.replace(/^\?/,"") ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

edgeone-bin/edgeone.jsView on unpkg · L2

5`).join(`

6`+o),t.push(s+"m+"+Ue.exports.humanize(this.diff)+"\x1B[0m")}else t[0]=Ws()+e+" "+t[0]}function Ws(){return

7`)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=

8`).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,

Long lines were clipped for display.

•matchType = normalized_sha256 matchedPackage = edgeone@1.6.34 matchedPath = edgeone-bin/edgeone.js matchedIdentity = npm:ZWRnZW9uZQ:1.6.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

edgeone-bin/edgeone.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 48dcd752ecac19f9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = edgeone@1.6.34 matchedPath = edgeone-bin/edgeone.js matchedIdentity = npm:ZWRnZW9uZQ:1.6.34 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

edgeone-bin/edgeone.jsView on unpkg

edgeone-dist/pages/observability-python/bootstrap.pyView file

•path = edgeone-dist/pages/observability-python/bootstrap.py kind = build_helper sizeBytes = 5257 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

edgeone-dist/pages/observability-python/bootstrap.pyView on unpkg

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView file

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = high_entropy_blob sizeBytes = 22939 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = compressed_blob sizeBytes = 22939 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

•path = libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 22939 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

libs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whlView on unpkg

edgeone-dist/studio/ui/assets/tea-Slf_ajmf.jsView file

•path = edgeone-dist/studio/ui/assets/tea-Slf_ajmf.js kind = oversized_source_file sizeBytes = 4904963 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

edgeone-dist/studio/ui/assets/tea-Slf_ajmf.jsView on unpkg

edgeone-dist/cli.jsView file

•path = edgeone-dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 9682392 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

edgeone-dist/cli.jsView on unpkg

edgeone-dist/pages/dev/runner-worker.jsView file

•matchType = normalized_sha256 matchedPackage = edgeone@1.6.34 matchedPath = edgeone-dist/pages/dev/runner-worker.js matchedIdentity = npm:ZWRnZW9uZQ:1.6.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

edgeone-dist/pages/dev/runner-worker.jsView on unpkg

Source & flagged code

14 flagged · loading source

edgeone-bin/edgeone.jsView file

7`)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0... L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...

High

Child Process

Package source references child process execution.

edgeone-bin/edgeone.jsView on unpkg · L7

2var _a; L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr... L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([... L5: `).join(` ... L7: `)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0... L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

edgeone-bin/edgeone.jsView on unpkg · L2

Findings

9 High8 Medium7 Low

HighChild Processedgeone-bin/edgeone.js

HighShell

HighSame File Env Network Executionedgeone-bin/edgeone.js

HighCommand Output Exfiltrationedgeone-bin/edgeone.js

HighTrigger Reachable Command Output Exfiltrationedgeone-bin/edgeone.js

HighShips High Entropy Bloblibs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl

HighKnown Malware Source Similarityedgeone-bin/edgeone.js

HighKnown Malware Source Similarityedgeone-dist/pages/dev/runner-worker.js

HighKnown Malware Source Fingerprint Signatureedgeone-bin/edgeone.js

MediumDynamic Requireedgeone-bin/edgeone.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to edgeone@1.6.37.

See all versions of edgeone for other recorded verdicts.

Review the evidence and your use of edgeone@1.6.37 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-10 03:22:55.831Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.