edgeone@1.6.43
Command-line interface for TencentCloud Pages Functions
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package is a TencentCloud Pages CLI with a build-only prepublish hook. Its inspected telemetry runs after a CLI invocation, targets Tencent CLS, and filters sensitive argument values; the scanner hints do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user invokes the CLI; the wrapper reports telemetry when the child process exits.
Impact
The source supports routine operational telemetry, not credential theft or command-output exfiltration.
Mechanism
The wrapper forwards CLI events and exit status to Tencent CLS. The CLI filters token-like argument values and reports their presence rather than their contents.
AI rationale
The package is a TencentCloud Pages CLI with a build-only prepublish hook. Its inspected telemetry runs after a CLI invocation, targets Tencent CLS, and filters sensitive argument values; the scanner hints do not establish malicious behavior.
Evidence
edgeone-bin/edgeone.jsedgeone-dist/cli.js
Network endpoints2
ap-nanjing.cls.tencentcs.comap-singapore.cls.tencentcs.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies edgeone as a TencentCloud Pages CLI; its bin points to the CLI wrapper, and prepublishOnly runs build and asset verification.
- The studio asset begins with imports from React, React DOM, and Moment.
- When the CLI wrapper exits, it sends an exit event through its telemetry reporter; the reporter targets Tencent CLS and includes the machine's local IP.
- CLI telemetry includes runtime and command metadata; its argument filter omits token-like values and records only whether sensitive values were supplied.
- The inspected archive analysis shows a Pages Blob SDK with caller-invoked get, set, and list operations.
- The runner-worker file is a bundled JavaScript runtime; the inspected entry excerpt contains bundler helpers.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
13 flagged · loading sourceedgeone-bin/edgeone.jsView file
7`)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0...
L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...
High
Child Process
Package source references child process execution.
edgeone-bin/edgeone.jsView on unpkg · L72var _a;
L3: var Un=Object.create;var jt=Object.defineProperty;var Bn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var Mn=Object.getPrototypeOf,jn=Object.prototype.hasOwnPr...
L4: `),function(u){if(o=u.indexOf(":"),n=et.trim(u.substr(0,o)).toLowerCase(),s=et.trim(u.substr(o+1)),n){if(r[n]&&Es.indexOf(n)>=0)return;n==="set-cookie"?r[n]=(r[n]?r[n]:[]).concat([...
L5: `).join(`
...
L7: `)}function Ys(t){t?process.env.DEBUG=t:delete process.env.DEBUG}function Zs(){return process.env.DEBUG}function Ks(t){t.inspectOpts={};let e=Object.keys(E.inspectOpts);for(let r=0...
L8: `).map(e=>e.trim()).join(" ")};Ir.O=function(t){return this.inspectOpts.colors=this.useColors,Ae.inspect(t,this.inspectOpts)}});var Pr=p((Ei,it)=>{typeof process>"u"||process.type=...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
edgeone-bin/edgeone.jsView on unpkg · L2Findings
7 High8 Medium7 Low
HighChild Processedgeone-bin/edgeone.js
HighSame File Env Network Executionedgeone-bin/edgeone.js
HighCommand Output Exfiltrationedgeone-bin/edgeone.js
HighTrigger Reachable Command Output Exfiltrationedgeone-bin/edgeone.js
HighShips High Entropy Bloblibs-pages-blob-python/pages_blob_python-0.12.0-py3-none-any.whl
HighKnown Malware Source Similarityedgeone-bin/edgeone.js
HighKnown Malware Source Similarityedgeone-dist/pages/dev/runner-worker.js
MediumDynamic Requireedgeone-bin/edgeone.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperedgeone-dist/pages/observability-python/bootstrap.py
Medium
Affected versions and remediation
This report applies to edgeone@1.6.43.
See all versions of edgeone for other recorded verdicts.
- Review the evidence and your use of edgeone@1.6.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.