registry / meow-tool / 0.2.1

meow-tool@0.2.1

Multi-provider LLM router exposing OpenAI/Anthropic compatible APIs, with smart mode routing, SSE streaming, session persistence, token analytics, and unified Agent/Skill/MCP orchestration, served via TUI CLI and Web UI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 1.24 MB of source, external domains: 1.2.3.4, element-plus.org, github.com, oss-cn-hangzhou.aliyuncs.com, vuejs.org, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 20-60json

20 "anthropic",

21 "mcp",

22 "cli",

23 "tui",

24 "ink",

25 "proxy",

26 "ai"

27 ],

28 "engines": {

29 "node": ">=20"

30 },

31 "scripts": {

32 "start": "node --import tsx src/bin/meow.ts dev",

33 "cli": "node --import tsx src/bin/meow.ts cli",

34 "dev": "node --import tsx src/bin/meow.ts dev",

35 "build": "tsc && cd web && npm run build && cd .. && node scripts/copy-web.mjs",

36 "typecheck": "tsc --noEmit",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "prepublishOnly": "node scripts/prepublish.mjs",

40 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "bin": {

43 "meow": "dist/bin/meow.js"

44 },

45 "files": [

46 "dist/",

47 "scripts/postinstall.mjs",

48 "scripts/prepublish.mjs",

49 "scripts/copy-web.mjs",

50 "LICENSE",

51 "README.md"

52 ],

53 "dependencies": {

54 "@aws-sdk/client-s3": "^3.1080.0",

55 "@hono/node-server": "^1.13.7",

56 "@modelcontextprotocol/sdk": "^1.29.0",

57 "better-sqlite3": "^12.11.1",

58 "cli-cursor": "^5.0.0",

59 "hono": "^4.6.14",

60 "ink": "^5.2.1",

dist/bin/meow.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Meow-Tool 统一 CLI 入口

3//

4// 开发:npm start(= meow dev,前台)| npm run cli(= meow cli)

5// 打包:npm link 后用 meow start/stop/cli/status

6import { spawn, spawnSync } from 'node:child_process';

7import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, openSync, } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/bin/meow.jsView on unpkg · L5

dist/web/assets/index-C2_62HTP.jsView file

270`)){var p=new Qd;p.newline=!0,u.add(p);return}var m=i.getSeriesByName(g)[0];if(!c.get(g))if(m){var y=m.getData(),_=y.getVisual("legendLineStyle")||{},b=y.getVisual("legendIcon"),w=... L271: `||i==="")){var a=e.isSelected(i);Ms(n,i)?n[i]=n[i]&&a:n[i]=a}}),n}function Yoe(e){e.registerAction("legendToggleSelect","legendselectchanged",Wt(ju,"toggleSelected")),e.registerAc... L272: `;const kse=Ese(),Dse="ecTheme",Pse="ecInitOptions",Ose="ecUpdateOptions",HT=/(^&?~?!?)native:/;var UT=Pe({name:"echarts",props:{option:Object,theme:{type:[Object,String]},initOpti...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web/assets/index-C2_62HTP.jsView on unpkg · L270

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/meow.jsView file

5// 打包:npm link 后用 meow start/stop/cli/status L6: import { spawn, spawnSync } from 'node:child_process'; L7: import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, openSync, } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/bin/meow.jsView on unpkg · L5

196const cmd = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open'; L197: spawn(cmd, [url], { shell: true, detached: true, stdio: 'ignore' }).unref(); L198: }

High

Shell

Package source references shell execution.

dist/bin/meow.jsView on unpkg · L196

184// 后端会跑 mcp.disconnectAll + closeDb + pushOnShutdown,然后再 process.exit L185: const port = process.env.PORT ?? '4399'; L186: await gracefulShutdownBackend(port, pids.backend); ... L192: const port = process.env.PORT ?? '4399'; L193: const url = `http://localhost:${port}`; L194: console.log(`[meow] 正在打开浏览器: ${url}`); ... L196: const cmd = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open'; L197: spawn(cmd, [url], { shell: true, detached: true, stdio: 'ignore' }).unref(); L198: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/meow.jsView on unpkg · L184

dist/web/assets/index-C2_62HTP.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web/assets/index-C2_62HTP.jsView on unpkg · L270

Findings

4 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/bin/meow.js

HighShelldist/bin/meow.js

HighSame File Env Network Executiondist/bin/meow.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/web/assets/index-C2_62HTP.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 20-60json

20 "anthropic",

21 "mcp",

22 "cli",

23 "tui",

24 "ink",

25 "proxy",

26 "ai"

27 ],

28 "engines": {

29 "node": ">=20"

30 },

31 "scripts": {

32 "start": "node --import tsx src/bin/meow.ts dev",

33 "cli": "node --import tsx src/bin/meow.ts cli",

34 "dev": "node --import tsx src/bin/meow.ts dev",

35 "build": "tsc && cd web && npm run build && cd .. && node scripts/copy-web.mjs",

36 "typecheck": "tsc --noEmit",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "prepublishOnly": "node scripts/prepublish.mjs",

40 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "bin": {

43 "meow": "dist/bin/meow.js"

44 },

45 "files": [

46 "dist/",

47 "scripts/postinstall.mjs",

48 "scripts/prepublish.mjs",

49 "scripts/copy-web.mjs",

50 "LICENSE",

51 "README.md"

52 ],

53 "dependencies": {

54 "@aws-sdk/client-s3": "^3.1080.0",

55 "@hono/node-server": "^1.13.7",

56 "@modelcontextprotocol/sdk": "^1.29.0",

57 "better-sqlite3": "^12.11.1",

58 "cli-cursor": "^5.0.0",

59 "hono": "^4.6.14",

60 "ink": "^5.2.1",

dist/bin/meow.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Meow-Tool 统一 CLI 入口

3//

4// 开发:npm start(= meow dev,前台)| npm run cli(= meow cli)

5// 打包:npm link 后用 meow start/stop/cli/status

6import { spawn, spawnSync } from 'node:child_process';

7import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, openSync, } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/bin/meow.jsView on unpkg · L5

dist/web/assets/index-C2_62HTP.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web/assets/index-C2_62HTP.jsView on unpkg · L270

Lines 164-216javascript

164 detached: true,

165 stdio: ['ignore', bLog, bLog],

166 windowsHide: true,

167 });

168 backend.unref();

169 writePids({ backend: backend.pid });

170 console.log('[meow] 已后台启动');

171 console.log(` 后端 :${backend.pid} → http://localhost:4399`);

172 console.log(` 前端 : http://localhost:4399 (静态文件服务)`);

173 console.log(` 日志 : ${LOG_DIR}/backend.log`);

174 console.log(` 停止 : meow stop`);

175}

176async function stop() {

177 const pids = readPids();

178 if (!pids) {

179 console.log('[meow] 未在运行');

180 process.exit(0);

181 }

182 console.log('[meow] 停止后端(等待后端 shutdown 钩子完成 OSS 上传)...');

183 // 先 HTTP /v1/shutdown 触发后端优雅关闭(Windows detached 进程无法收 SIGINT)

184 // 后端会跑 mcp.disconnectAll + closeDb + pushOnShutdown,然后再 process.exit

185 const port = process.env.PORT ?? '4399';

186 await gracefulShutdownBackend(port, pids.backend);

187 clearPids();

188 console.log('[meow] 已停止');

189}

190// web:打开浏览器访问前端页面

191function web() {

192 const port = process.env.PORT ?? '4399';

193 const url = `http://localhost:${port}`;

194 console.log(`[meow] 正在打开浏览器: ${url}`);

195 // 跨平台打开浏览器

196 const cmd = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open';

197 spawn(cmd, [url], { shell: true, detached: true, stdio: 'ignore' }).unref();

198}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/meow.jsView on unpkg · L184

High

Shell

Package source references shell execution.

dist/bin/meow.jsView on unpkg · L196

199function cli() {

200 // 转发参数到 CLI(默认 chat),每次启动都会创建新 session

201 const args = process.argv.slice(3);

202 if (args.length === 0)

203 args.push('chat');

204 // node dist/cli/index.js(编译产物)

205 const child = spawn(process.execPath, ['dist/cli/index.js', ...args], {

206 cwd: ROOT,

207 stdio: 'inherit',

208 });

209 child.on('exit', (c) => process.exit(c ?? 0));

210}

211function status() {

212 const pids = readPids();

213 if (!pids) {

214 console.log('[meow] 未运行');

215 return;

216 }