edgeone@1.6.39
Command-line interface for TencentCloud Pages Functions
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package lacks automatic install execution and no concrete malware behavior was established. Environment propagation plus a compressed bundled wheel leave a meaningful review risk, so this is downgraded rather than marked clean.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Running the edgeone CLI development workflow.
Impact
Project-controlled runtime code may receive environment values; the inspected package source does not show package-controlled secret exfiltration.
Mechanism
Development-worker environment propagation.
AI rationale
The package lacks automatic install execution and no concrete malware behavior was established. Environment propagation plus a compressed bundled wheel leave a meaningful review risk, so this is downgraded rather than marked clean.
Evidence
edgeone-dist/pages/dev/runner-worker.js
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Unknown with high false-positive risk.
Evidence for warning
- The package contains a compressed Python wheel, which requires archive-aware inspection.
- The development worker copies environment values into its execution context and makes build-time .env values available to runtime tools.
- The published command launches a large bundled CLI and development worker, increasing the effect of any environment exposure.
Evidence against
- The manifest has no preinstall, install, or postinstall hook.
- There is no runtime dependency on edgeone itself.
- The wheel contains inspectable Python blob-storage sources rather than a native executable.
- Observed service endpoints are EdgeOne service endpoints used by the CLI.
- No source showed secret harvesting followed by package-controlled exfiltration or destructive install-time activity.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
14 flagged · loading sourceedgeone-bin/edgeone.jsView file
7`)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0...
L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...
High
Child Process
Package source references child process execution.
edgeone-bin/edgeone.jsView on unpkg · L72var _a;
L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr...
L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([...
L5: `).join(`
...
L7: `)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0...
L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
edgeone-bin/edgeone.jsView on unpkg · L2Findings
9 High8 Medium7 Low
HighChild Processedgeone-bin/edgeone.js
HighShell
HighSame File Env Network Executionedgeone-bin/edgeone.js
HighCommand Output Exfiltrationedgeone-bin/edgeone.js
HighTrigger Reachable Command Output Exfiltrationedgeone-bin/edgeone.js
HighShips High Entropy Bloblibs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl
HighKnown Malware Source Similarityedgeone-bin/edgeone.js
HighKnown Malware Source Similarityedgeone-dist/pages/dev/runner-worker.js
HighKnown Malware Source Fingerprint Signatureedgeone-bin/edgeone.js
MediumDynamic Requireedgeone-bin/edgeone.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to edgeone@1.6.39.
See all versions of edgeone for other recorded verdicts.
- Review the evidence and your use of edgeone@1.6.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.