registry / gaoding-cli / 1.0.0-alpha.24

gaoding-cli@1.0.0-alpha.24

⚠ Under review

Gaoding command-line interface for agents and people.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 370 KB of source, external domains: 127.0.0.1, gaoding-log-ai-gpu.cn-hangzhou.log.aliyuncs.com, gdcli.gaoding.com, registry.npmjs.org, www.gaoding.art, www.gaoding.com

Source & flagged code

5 flagged

package.jsonView file

Lines 14-54json

14 },

15 "bin": {

16 "gd-cli": "dist/bin/gd-cli.js"

17 },

18 "files": [

19 "contracts",

20 "dist",

21 "skills",

22 "README.md",

23 "LICENSE"

24 ],

25 "scripts": {

26 "contracts:build": "pnpm --filter @gaoding/gd-connector-contracts build",

27 "clean": "node -e \"for (const p of ['contracts', 'dist']) require('node:fs').rmSync(p, { recursive: true, force: true })\"",

28 "bundle:contracts": "node scripts/bundle-contracts.mjs",

29 "build": "pnpm contracts:build && pnpm clean && tsc -p tsconfig.build.json && pnpm bundle:contracts",

30 "test": "pnpm contracts:build && vitest run",

31 "typecheck": "pnpm contracts:build && tsc -p tsconfig.json",

32 "check": "pnpm contracts:build && vitest run && tsc -p tsconfig.json && pnpm clean && tsc -p tsconfig.build.json && pnpm bundle:contracts",

33 "prepack": "pnpm check",

34 "postinstall": "node -e \"const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L34

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

35 },

36 "dependencies": {

37 "ajv": "8.20.0",

38 "ajv-formats": "3.0.1",

39 "ali-oss": "6.23.0",

40 "commander": "14.0.3",

41 "open": "11.0.0",

42 "qrcode": "1.5.4",

43 "semver": "7.8.5",

44 "sharp": "0.35.3",

45 "ws": "8.21.1"

46 },

47 "devDependencies": {

48 "@gaoding/gd-connector-contracts": "workspace:*",

49 "@types/ali-oss": "6.23.3",

50 "@types/node": "24.13.3",

51 "@types/qrcode": "1.5.6",

52 "@types/semver": "7.7.1",

53 "@types/ws": "8.18.1",

54 "typescript": "7.0.2",

dist/src/features/dam/object-storage.jsView file

Lines 1-32javascript

1import { createHmac } from "node:crypto";

2import { createReadStream } from "node:fs";

3import { stat } from "node:fs/promises";

4import OSS from "ali-oss"

dist/src/platform/url-safety.jsView file

Lines 1-21javascript

1import { isIP } from "node:net";

2export class UrlSafetyError extends Error {

3 constructor() {

4 super("URL 不可用于远程素材。");

dist/src/features/update/update-service.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = gaoding-cli@1.0.0-alpha.22 matchedIdentity = npm:Z2FvZGluZy1jbGk:1.0.0-alpha.22 similarity = 0.864 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/features/update/update-service.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const p='./dist/bin/postinstall.js'; if (require('node:fs').existsSync(p)) import(p)"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/features/dam/object-storage.jsView file

12try { L13: const url = new URL(value.includes("://") ? value : `https://${value}`); L14: if (url.protocol !== "http:" && url.protocol !== "https:") { ... L130: .update(stringToSign) L131: .digest("base64"); L132: const stream = createReadStream(input.filePath); ... L142: }, L143: body: stream, L144: signal: input.signal,

Findings

2 Critical2 High3 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalPrevious Version Dangerous Deltadist/src/features/update/update-service.js

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accessdist/src/platform/url-safety.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/src/features/dam/object-storage.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to gaoding-cli@1.0.0-alpha.24.

See all versions of gaoding-cli for other recorded verdicts.

Review the evidence and your use of gaoding-cli@1.0.0-alpha.24 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 10:16:40.039Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.