registry / jinzd-ai-cli / 0.4.214

jinzd-ai-cli@0.4.214

Cross-platform REPL-style AI CLI with multi-provider support

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 77 file(s), 2.63 MB of source, external domains: 127.0.0.1, ai.dev, api.deepseek.com, api.minimaxi.com, api.moonshot.ai, api.openai.com, cn.bing.com, console.cloud.google.com, github.com, mths.be, ollama.com, open.bigmodel.cn, openrouter.ai, programmablesearchengine.google.com, registry.npmjs.org, tailwindcss.com, twitter.com, www.googleapis.com

Source & flagged code

10 flagged

dist/ci-3TU7WCY4.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import {

3 buildReviewPrompt,

4 buildSecurityReviewPrompt,

5 truncateDiff

6} from "./chunk-HLWUDRBO.js";

7import {

8 ProviderRegistry

9} from "./chunk-QMXC327F.js";

10import "./chunk-XPBEJB27.js";

11import {

12 ConfigManager

13} from "./chunk-YFHF3PVB.js";

14import "./chunk-TZQHYZKT.js";

15import {

16 VERSION

17} from "./chunk-DBYMX2ZC.js";

18import "./chunk-IW3Q7AE5.js";

20// src/cli/ci.ts

21import { execFileSync } from "child_process";

22var CI_COMMENT_MARKER = "";

High

Child Process

Package source references child process execution.

dist/ci-3TU7WCY4.jsView on unpkg · L20

23function fetchDiff(opts) {

24 if (opts.diffOverride != null) return opts.diffOverride;

25 if (opts.pr != null) {

26 try {

27 return execFileSync("gh", ["pr", "diff", String(opts.pr)], {

28 encoding: "utf-8",

29 maxBuffer: 50 * 1024 * 1024

30 });

31 } catch (err) {

32 const msg = err.stderr?.toString() ?? err.message;

33 throw new Error(`gh pr diff ${opts.pr} failed: ${msg.trim()}`);

34 }

35 }

36 if (opts.base) {

37 try {

38 validateGitRef(opts.base);

39 return execFileSync("git", ["diff", `${opts.base}...HEAD`], {

40 encoding: "utf-8",

dist/electron-server.jsView file

High

Shell

Package source references shell execution.

dist/electron-server.jsView on unpkg · L725

86// 可选：直接在此写 key（也可通过 apiKeys 字段或环境变量提供） L87: baseUrl: z.string(), L88: // OpenAI 兼容 API 的 base URL（必填） ... L498: try { L499: const raw = JSON.parse(readFileSync(this.configPath, "utf-8")); L500: return ConfigSchema.parse(raw); ... L4796: // src/tools/builtin/bash.ts L4797: import { spawn } from "child_process"; L4798: import { existsSync as existsSync4, readdirSync as readdirSync2, statSync } from "fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/electron-server.jsView on unpkg · L86

61Detached bundled service listener: dist/electron-server.js launches a Node helper and exposes a broad-bound HTTP listener. L61: import express from "express"; L62: import { createServer } from "http"; L63: import { WebSocketServer } from "ws"; ... L247: denyPorts: z.array(z.number().int().min(1).max(65535)).default([]), L248: allowPrivateNetwork: z.boolean().default(false), L249: tools: z.object({ ... L400: if (fixedEnvVar && fixedEnvVar !== dynamicEnvVar) { L401: const fixedVal = process.env[fixedEnvVar]; L402: const dynVal = process.env[dynamicEnvVar]; L403: if (fixedVal && dynVal && fixedVal !== dynVal) { L404: process.stderr.write(`[warn] env var collision: ${fixedEnvVar} and ${dynamicEnvVar} have different values for provider "${providerId}". Using ${fixedEnvVar}. L405: `);

dist/web/client/vendor/tailwind.jsView file

Lines 1-21javascript

1(()=>{var qv=Object.create;var Hi=Object.defineProperty;var $v=Object.getOwnPropertyDescriptor;var Lv=Object.getOwnPropertyNames;var Mv=Object.getPrototypeOf,Nv=Object.prototype.hasOwnProperty;var df=r=>Hi(r,"__esModule",{value:!

dist/chunk-CKH4KQ4E.jsView file

Lines 32-72javascript

32 case "rs":

33 return "rust";

34 case "java":

35 return "java";

36 case "c":

37 case "cc":

dist/chunk-5FG7PSVM.jsView file

Lines 834-874javascript

834 }

835 /** 获取激活技能的 prompt 内容（null 表示无激活技能） */

836 getActivePromptContent() {

837 return this.activeSkill?.content ?? null;

838 }

839 /** 获取激活技能的工具白名单 Set（null 表示无限制） */

840 getActiveToolFilter() {

841 if (

dist/wasm/tree-sitter-go.wasmView file

•path = dist/wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/tree-sitter-go.wasmView on unpkg

dist/chunk-R5CJD2AB.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = jinzd-ai-cli@0.4.210 matchedIdentity = npm:amluemQtYWktY2xp:0.4.210 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-R5CJD2AB.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/ci-3TU7WCY4.jsView file

20// src/cli/ci.ts L21: import { execFileSync } from "child_process"; L22: var CI_COMMENT_MARKER = "";

High

Child Process

Package source references child process execution.

dist/ci-3TU7WCY4.jsView on unpkg · L20

dist/electron-server.jsView file

High

Shell

Package source references shell execution.

dist/electron-server.jsView on unpkg · L725

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/electron-server.jsView on unpkg · L86

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/electron-server.jsView on unpkg · L61

61import express from "express"; L62: import { createServer } from "http"; L63: import { WebSocketServer } from "ws"; ... L247: denyPorts: z.array(z.number().int().min(1).max(65535)).default([]), L248: allowPrivateNetwork: z.boolean().default(false), L249: tools: z.object({ ... L400: if (fixedEnvVar && fixedEnvVar !== dynamicEnvVar) { L401: const fixedVal = process.env[fixedEnvVar]; L402: const dynVal = process.env[dynamicEnvVar]; L403: if (fixedVal && dynVal && fixedVal !== dynVal) { L404: process.stderr.write(`[warn] env var collision: ${fixedEnvVar} and ${dynamicEnvVar} have different values for provider "${providerId}". Using ${fixedEnvVar}. L405: `);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/electron-server.jsView on unpkg · L61

dist/web/client/vendor/tailwind.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/client/vendor/tailwind.jsView on unpkg · L1

dist/chunk-CKH4KQ4E.jsView file

52function indexDir() { L53: return path.join(os.homedir(), ".aicli", INDEX_DIR_NAME); L54: } ... L66: const raw = fs.readFileSync(p, "utf-8"); L67: const parsed = JSON.parse(raw); L68: if (parsed.version !== SYMBOL_INDEX_VERSION) return null;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-CKH4KQ4E.jsView on unpkg · L52

dist/chunk-5FG7PSVM.jsView file

854package = jinzd-ai-cli; repositoryIdentity = ai-cli; dependency = undici L854: try { L855: const { ProxyAgent, setGlobalDispatcher } = await import("undici"); L856: setGlobalDispatcher(new ProxyAgent({ uri: proxyUrl }));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-5FG7PSVM.jsView on unpkg · L854

dist/wasm/tree-sitter-go.wasmView file

•path = dist/wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/tree-sitter-go.wasmView on unpkg

dist/chunk-R5CJD2AB.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-R5CJD2AB.jsView on unpkg

Findings

6 High6 Medium7 Low

HighChild Processdist/ci-3TU7WCY4.js

HighShelldist/electron-server.js

HighRemote Agent Bridgedist/electron-server.js

HighCopied Package Dependency Bridgedist/chunk-5FG7PSVM.js

HighSpawned Bundled Service Listenerdist/electron-server.js

HighPrevious Version Dangerous Deltadist/chunk-R5CJD2AB.js

MediumDynamic Requiredist/web/client/vendor/tailwind.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/electron-server.js

MediumShips Wasm Moduledist/wasm/tree-sitter-go.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/chunk-CKH4KQ4E.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

dist/ci-3TU7WCY4.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import {

3 buildReviewPrompt,

4 buildSecurityReviewPrompt,

5 truncateDiff

6} from "./chunk-HLWUDRBO.js";

7import {

8 ProviderRegistry

9} from "./chunk-QMXC327F.js";

10import "./chunk-XPBEJB27.js";

11import {

12 ConfigManager

13} from "./chunk-YFHF3PVB.js";

14import "./chunk-TZQHYZKT.js";

15import {

16 VERSION

17} from "./chunk-DBYMX2ZC.js";

18import "./chunk-IW3Q7AE5.js";

20// src/cli/ci.ts

21import { execFileSync } from "child_process";

22var CI_COMMENT_MARKER = "";

High

Child Process

Package source references child process execution.

dist/ci-3TU7WCY4.jsView on unpkg · L20

23function fetchDiff(opts) {

24 if (opts.diffOverride != null) return opts.diffOverride;

25 if (opts.pr != null) {

26 try {

27 return execFileSync("gh", ["pr", "diff", String(opts.pr)], {

28 encoding: "utf-8",

29 maxBuffer: 50 * 1024 * 1024

30 });

31 } catch (err) {

32 const msg = err.stderr?.toString() ?? err.message;

33 throw new Error(`gh pr diff ${opts.pr} failed: ${msg.trim()}`);

34 }

35 }

36 if (opts.base) {

37 try {

38 validateGitRef(opts.base);

39 return execFileSync("git", ["diff", `${opts.base}...HEAD`], {

40 encoding: "utf-8",

dist/electron-server.jsView file

High

Shell

Package source references shell execution.

dist/electron-server.jsView on unpkg · L725

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/electron-server.jsView on unpkg · L86

dist/web/client/vendor/tailwind.jsView file

Lines 1-21javascript

dist/chunk-CKH4KQ4E.jsView file

Lines 32-72javascript

32 case "rs":

33 return "rust";

34 case "java":

35 return "java";

36 case "c":

37 case "cc":

dist/chunk-5FG7PSVM.jsView file

Lines 834-874javascript

834 }

835 /** 获取激活技能的 prompt 内容（null 表示无激活技能） */

836 getActivePromptContent() {

837 return this.activeSkill?.content ?? null;

838 }

839 /** 获取激活技能的工具白名单 Set（null 表示无限制） */

840 getActiveToolFilter() {

841 if (

dist/wasm/tree-sitter-go.wasmView file

•path = dist/wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/tree-sitter-go.wasmView on unpkg

dist/chunk-R5CJD2AB.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-R5CJD2AB.jsView on unpkg