registry / meow-tool / 0.3.0

meow-tool@0.3.0

Multi-provider LLM router exposing OpenAI/Anthropic compatible APIs, with smart mode routing, SSE streaming, session persistence, token analytics, and unified Agent/Skill/MCP orchestration, served via TUI CLI and Web UI

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 112 file(s), 1.98 MB of source, external domains: element-plus.org, github.com, oss-cn-hangzhou.aliyuncs.com, vuejs.org, www.w3.org

Source & flagged code

7 flagged

package.jsonView file

Lines 22-62json

22 "cli",

23 "tui",

24 "ink",

25 "proxy",

26 "ai",

27 "meow"

28 ],

29 "engines": {

30 "node": ">=20"

31 },

32 "scripts": {

33 "start": "node --import tsx src/bin/meow.ts dev",

34 "cli": "node --import tsx src/bin/meow.ts cli",

35 "dev": "node --import tsx src/bin/meow.ts dev",

36 "clean": "node -e \"import('node:fs').then(f=>f.rmSync('dist',{recursive:true,force:true}))\"",

37 "build": "npm run clean && tsc && cd web && npm run build && cd .. && node scripts/copy-web.mjs",

38 "typecheck": "tsc --noEmit",

39 "test": "vitest run",

40 "test:watch": "vitest",

41 "prepublishOnly": "node scripts/prepublish.mjs",

42 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "bin": {

45 "meow": "dist/bin/meow.js"

46 },

47 "files": [

48 "dist/",

49 "scripts/postinstall.mjs",

50 "LICENSE",

51 "README.md"

52 ],

53 "dependencies": {

54 "@aws-sdk/client-s3": "^3.1080.0",

55 "@hono/node-server": "^1.13.7",

56 "@modelcontextprotocol/sdk": "^1.29.0",

57 "better-sqlite3": "^12.11.1",

58 "cli-cursor": "^5.0.0",

59 "hono": "^4.6.14",

60 "ink": "^7.0.3",

61 "react": "^19.0.0",

62 "tsx": "^4.19.2",

dist/bin/meow.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Meow-Tool 统一 CLI 入口

3//

4// 开发:npm start(= meow dev,前台)| npm run cli(= meow cli)

5// 打包:npm link 后用 meow start/stop/cli/status

6import { spawn, spawnSync } from 'node:child_process';

7import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, openSync, } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/bin/meow.jsView on unpkg · L5

dist/web/assets/vendor-echarts-CCfCPPq6.jsView file

51`)){var g=new ja;g.newline=!0,u.add(g);return}var y=n.getSeriesByName(p)[0];if(!f.get(p))if(y){var m=y.getData(),_=m.getVisual("legendLineStyle")||{},S=m.getVisual("legendIcon"),x=... L52: `||n==="")){var a=r.isSelected(n);ri(e,n)?e[n]=e[n]&&a:e[n]=a}}),e}function gA(r){r.registerAction("legendToggleSelect","legendselectchanged",yt(Sn,"toggleSelected")),r.registerAct... L53: `;const KA=qA(),QA="ecTheme",JA="ecInitOptions",jA="ecUpdateOptions",Xd=/(^&?~?!?)native:/;var uL=Fm({name:"echarts",props:{option:Object,theme:{type:[Object,String]},initOptions:O...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web/assets/vendor-echarts-CCfCPPq6.jsView on unpkg · L51

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/meow.jsView file

5// 打包:npm link 后用 meow start/stop/cli/status L6: import { spawn, spawnSync } from 'node:child_process'; L7: import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, openSync, } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/bin/meow.jsView on unpkg · L5

196const cmd = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open'; L197: spawn(cmd, [url], { shell: true, detached: true, stdio: 'ignore' }).unref(); L198: }

High

Shell

Package source references shell execution.

dist/bin/meow.jsView on unpkg · L196

184// 后端会跑 mcp.disconnectAll + closeDb + pushOnShutdown,然后再 process.exit L185: const port = process.env.PORT ?? '4399'; L186: await gracefulShutdownBackend(port, pids.backend); ... L192: const port = process.env.PORT ?? '4399'; L193: const url = `http://localhost:${port}`; L194: console.log(`[meow] 正在打开浏览器: ${url}`); ... L196: const cmd = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open'; L197: spawn(cmd, [url], { shell: true, detached: true, stdio: 'ignore' }).unref(); L198: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/meow.jsView on unpkg · L184

•matchType = previous_version_dangerous_delta matchedPackage = meow-tool@0.2.1 matchedIdentity = npm:bWVvdy10b29s:0.2.1 similarity = 0.860 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/meow.jsView on unpkg

dist/web/assets/vendor-echarts-CCfCPPq6.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web/assets/vendor-echarts-CCfCPPq6.jsView on unpkg · L51

Findings

5 High4 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/bin/meow.js

HighShelldist/bin/meow.js

HighSame File Env Network Executiondist/bin/meow.js

HighPrevious Version Dangerous Deltadist/bin/meow.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/web/assets/vendor-echarts-CCfCPPq6.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 22-62json

22 "cli",

23 "tui",

24 "ink",

25 "proxy",

26 "ai",

27 "meow"

28 ],

29 "engines": {

30 "node": ">=20"

31 },

32 "scripts": {

33 "start": "node --import tsx src/bin/meow.ts dev",

34 "cli": "node --import tsx src/bin/meow.ts cli",

35 "dev": "node --import tsx src/bin/meow.ts dev",

36 "clean": "node -e \"import('node:fs').then(f=>f.rmSync('dist',{recursive:true,force:true}))\"",

37 "build": "npm run clean && tsc && cd web && npm run build && cd .. && node scripts/copy-web.mjs",

38 "typecheck": "tsc --noEmit",

39 "test": "vitest run",

40 "test:watch": "vitest",

41 "prepublishOnly": "node scripts/prepublish.mjs",

42 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "bin": {

45 "meow": "dist/bin/meow.js"

46 },

47 "files": [

48 "dist/",

49 "scripts/postinstall.mjs",

50 "LICENSE",

51 "README.md"

52 ],

53 "dependencies": {

54 "@aws-sdk/client-s3": "^3.1080.0",

55 "@hono/node-server": "^1.13.7",

56 "@modelcontextprotocol/sdk": "^1.29.0",

57 "better-sqlite3": "^12.11.1",

58 "cli-cursor": "^5.0.0",

59 "hono": "^4.6.14",

60 "ink": "^7.0.3",

61 "react": "^19.0.0",

62 "tsx": "^4.19.2",

dist/bin/meow.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Meow-Tool 统一 CLI 入口

3//

4// 开发:npm start(= meow dev,前台)| npm run cli(= meow cli)

5// 打包:npm link 后用 meow start/stop/cli/status

6import { spawn, spawnSync } from 'node:child_process';

7import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, openSync, } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/bin/meow.jsView on unpkg · L5

dist/web/assets/vendor-echarts-CCfCPPq6.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web/assets/vendor-echarts-CCfCPPq6.jsView on unpkg · L51

Lines 164-216javascript

164 detached: true,

165 stdio: ['ignore', bLog, bLog],

166 windowsHide: true,

167 });

168 backend.unref();

169 writePids({ backend: backend.pid });

170 console.log('[meow] 已后台启动');

171 console.log(` 后端 :${backend.pid} → http://localhost:4399`);

172 console.log(` 前端 : http://localhost:4399 (静态文件服务)`);

173 console.log(` 日志 : ${LOG_DIR}/backend.log`);

174 console.log(` 停止 : meow stop`);

175}

176async function stop() {

177 const pids = readPids();

178 if (!pids) {

179 console.log('[meow] 未在运行');

180 process.exit(0);

181 }

182 console.log('[meow] 停止后端(等待后端 shutdown 钩子完成 OSS 上传)...');

183 // 先 HTTP /v1/shutdown 触发后端优雅关闭(Windows detached 进程无法收 SIGINT)

184 // 后端会跑 mcp.disconnectAll + closeDb + pushOnShutdown,然后再 process.exit

185 const port = process.env.PORT ?? '4399';

186 await gracefulShutdownBackend(port, pids.backend);

187 clearPids();

188 console.log('[meow] 已停止');

189}

190// web:打开浏览器访问前端页面

191function web() {

192 const port = process.env.PORT ?? '4399';

193 const url = `http://localhost:${port}`;

194 console.log(`[meow] 正在打开浏览器: ${url}`);

195 // 跨平台打开浏览器

196 const cmd = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open';

197 spawn(cmd, [url], { shell: true, detached: true, stdio: 'ignore' }).unref();

198}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/meow.jsView on unpkg · L184

High

Shell

Package source references shell execution.

dist/bin/meow.jsView on unpkg · L196

199function cli() {

200 // 转发参数到 CLI(默认 chat),每次启动都会创建新 session

201 const args = process.argv.slice(3);

202 if (args.length === 0)

203 args.push('chat');

204 // 优先用 tsx 跑源码(开发模式);回退到 dist 编译产物(生产模式)

205 const srcEntry = join(ROOT, 'src/cli/index.tsx');

206 const distEntry = join(ROOT, 'dist/cli/index.js');

207 let cmd;

208 let cmdArgs;

209 if (existsSync(srcEntry)) {

210 cmd = process.execPath;

211 cmdArgs = ['--import', 'tsx', srcEntry, ...args];

212 }

213 else {

214 cmd = process.execPath;

215 cmdArgs = [distEntry, ...args];

216 }