registry / tolingclaw / 1.0.43

tolingclaw@1.0.43

跨境电商轻量智能体框架

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 1.05 MB of source, external domains: api.deepseek.com, coding.dashscope.aliyuncs.com, dashscope.aliyuncs.com, github.com, token-plan.cn-beijing.maas.aliyuncs.com, toling.me, vuejs.org, www.w3.org

Oversized source lightweight scan

src/ControlUI/dist/assets/index-DZyM5dLW.js2.57 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedUrlStringsvuejs.orgwww.w3.org

Source & flagged code

7 flagged

package.jsonView file

Lines 29-69json

29 "src/skill.js",

30 "src/skill-manager.js",

31 "src/task-session.js",

32 "src/task-sync.js",

33 "src/system-skills.js",

34 "src/tool-registry.js",

35 "src/web.js",

36 "src/modules/",

37 "src/ControlUI/dist/",

38 "config/config.example.json",

39 ".skills/tuling-tutu/",

40 "LICENSE",

41 "README.md",

42 "CHANGELOG.md"

43 ],

44 "type": "module",

45 "bin": {

46 "tolingclaw": "./bin/tolingclaw.js"

47 },

48 "scripts": {

49 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "start": "node src/main.js",

51 "gateway": "node bin/tolingclaw.js gateway",

52 "web": "node bin/tolingclaw.js gateway",

53 "skill:new": "node src/skill-manager.js new",

54 "skill:list": "node src/skill-manager.js list",

55 "tool:test": "node src/tool-tester.js",

56 "ui:dev": "cd src/ControlUI && npm run dev",

57 "ui:build": "cd src/ControlUI && npm run build",

58 "ui:preview": "cd src/ControlUI && npm run preview",

59 "pkg:build": "pkg --config pkg.config.json bin/tolingclaw.js"

60 },

61 "dependencies": {

62 "@element-plus/icons-vue": "^2.3.2",

63 "axios": "^1.16.1",

64 "chalk": "^5.3.0",

65 "commander": "^12.1.0",

66 "element-plus": "^2.14.0",

67 "jimp": "^1.6.1",

68 "lowdb": "^7.0.0",

69 "mysql2": "^3.22.5",

src/modules/db.cjsView file

Lines 1-11javascript

1module.exports = {

2 host: 'rm-wz9giy9cn54hm8ub93o.mysql.rds.aliyuncs.com',

3 port: 3306,

4 user: 'xscrossdev',

5 password: 'xs@j23dkls326dksj694334d44s',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/modules/db.cjsView on unpkg · L5

6 database: 'tolingclaw',

bin/tolingclaw.jsView file

Lines 96-136javascript

96 const { dir: workDir, isDefault } = resolveWorkDir(opts.dir);

97 if (isDefault) {

98 ensureWorkspace(workDir);

99 }

100

101 // 优先使用工作目录的 src/main.js，否则用包自带的

102 let mainPath = findWorkspaceFile

bin/desktop-start.batView file

•path = bin/desktop-start.bat kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/desktop-start.batView on unpkg

src/ControlUI/dist/assets/index-DZyM5dLW.jsView file

•path = src/ControlUI/dist/assets/index-DZyM5dLW.js kind = oversized_source_file sizeBytes = 2690945 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/ControlUI/dist/assets/index-DZyM5dLW.jsView on unpkg

src/agent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = tolingclaw@1.0.40 matchedIdentity = npm:dG9saW5nY2xhdw:1.0.40 similarity = 0.961 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/agent.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/modules/db.cjsView file

5patternName = generic_password severity = medium line = 5 matchedText = password...4s',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/modules/db.cjsView on unpkg · L5

bin/tolingclaw.jsView file

116L117: const { main } = await import(pathToFileURL(mainPath).href); L118: await main();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tolingclaw.jsView on unpkg · L116

bin/desktop-start.batView file

•path = bin/desktop-start.bat kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/desktop-start.batView on unpkg

src/ControlUI/dist/assets/index-DZyM5dLW.jsView file

•path = src/ControlUI/dist/assets/index-DZyM5dLW.js kind = oversized_source_file sizeBytes = 2690945 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/ControlUI/dist/assets/index-DZyM5dLW.jsView on unpkg

src/agent.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/agent.jsView on unpkg

Findings

3 High7 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filesrc/ControlUI/dist/assets/index-DZyM5dLW.js

HighPrevious Version Dangerous Deltasrc/agent.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patternsrc/modules/db.cjs

MediumDynamic Requirebin/tolingclaw.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/desktop-start.bat

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 29-69json

29 "src/skill.js",

30 "src/skill-manager.js",

31 "src/task-session.js",

32 "src/task-sync.js",

33 "src/system-skills.js",

34 "src/tool-registry.js",

35 "src/web.js",

36 "src/modules/",

37 "src/ControlUI/dist/",

38 "config/config.example.json",

39 ".skills/tuling-tutu/",

40 "LICENSE",

41 "README.md",

42 "CHANGELOG.md"

43 ],

44 "type": "module",

45 "bin": {

46 "tolingclaw": "./bin/tolingclaw.js"

47 },

48 "scripts": {

49 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "start": "node src/main.js",

51 "gateway": "node bin/tolingclaw.js gateway",

52 "web": "node bin/tolingclaw.js gateway",

53 "skill:new": "node src/skill-manager.js new",

54 "skill:list": "node src/skill-manager.js list",

55 "tool:test": "node src/tool-tester.js",

56 "ui:dev": "cd src/ControlUI && npm run dev",

57 "ui:build": "cd src/ControlUI && npm run build",

58 "ui:preview": "cd src/ControlUI && npm run preview",

59 "pkg:build": "pkg --config pkg.config.json bin/tolingclaw.js"

60 },

61 "dependencies": {

62 "@element-plus/icons-vue": "^2.3.2",

63 "axios": "^1.16.1",

64 "chalk": "^5.3.0",

65 "commander": "^12.1.0",

66 "element-plus": "^2.14.0",

67 "jimp": "^1.6.1",

68 "lowdb": "^7.0.0",

69 "mysql2": "^3.22.5",

src/modules/db.cjsView file

Lines 1-11javascript

1module.exports = {

2 host: 'rm-wz9giy9cn54hm8ub93o.mysql.rds.aliyuncs.com',

3 port: 3306,

4 user: 'xscrossdev',

5 password: 'xs@j23dkls326dksj694334d44s',

Medium

Secret Pattern

Package contains a possible secret pattern.

src/modules/db.cjsView on unpkg · L5

6 database: 'tolingclaw',

bin/tolingclaw.jsView file

Lines 96-136javascript

96 const { dir: workDir, isDefault } = resolveWorkDir(opts.dir);

97 if (isDefault) {

98 ensureWorkspace(workDir);

99 }

100

101 // 优先使用工作目录的 src/main.js，否则用包自带的

102 let mainPath = findWorkspaceFile

bin/desktop-start.batView file

•path = bin/desktop-start.bat kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/desktop-start.batView on unpkg

src/ControlUI/dist/assets/index-DZyM5dLW.jsView file

•path = src/ControlUI/dist/assets/index-DZyM5dLW.js kind = oversized_source_file sizeBytes = 2690945 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/ControlUI/dist/assets/index-DZyM5dLW.jsView on unpkg

src/agent.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/agent.jsView on unpkg