registry / tt-help-cli-ycl / 1.4.113

tt-help-cli-ycl@1.4.113

⚠ Under review

TikTok user & video data scraper - extract ttSeller, verified, locationCreated from HTML source

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 110 file(s), 1.31 MB of source, external domains: 117.71.53.99, 127.0.0.1, 82.156.52.214, dashscope.aliyuncs.com, registry.npmjs.org, www.tiktok.com

Source & flagged code

7 flagged

scripts/test-upgrade-spawn.mjsView file

Lines 7-50javascript

7 * → 假 npm（FAKE_PKG/FAKE_VER 环境变量把 package.json version 改为 9.9.10）

8 * → U：下载(假 npm 改版本) → 验证(9.9.10) → 杀 A → spawn 新版 B(detached) → 存活确认

9 *

10 * 断言：

11 * - U 日志：验证通过 / 旧已退出 / 新版已启动 / 存活确认

12 * - A 已退出

13 * - B 进程存活（detached，U 退出后仍活）

14 *

15 * 用法：node scripts/test-upgrade-spawn.mjs

16 */

17import {

18 mkdtempSync,

19 writeFileSync,

20 copyFileSync,

21 chmodSync,

22 mkdirSync,

23 rmSync,

24 realpathSync,

25} from "fs";

26import { tmpdir } from "os";

27import { join } from "path";

28import { spawn, execFileSync } from "child_process";

High

Child Process

Package source references child process execution.

scripts/test-upgrade-spawn.mjsView on unpkg · L27

30const SRC = "/Users/yinchengliang/soft/tiktok/tiktok-cli";

31const REAL_NPM = execFileSync("which npm", { shell: true }).toString().trim();

32const tmp = mkdtempSync(join(tmpdir(), "tt-upgrade-test-"));

High

Shell

Package source references shell execution.

scripts/test-upgrade-spawn.mjsView on unpkg · L30

33const pkgDir = join(tmp, "pkg", "node_modules", "tt-help-cli-ycl");

34mkdirSync(join(pkgDir, "src", "watchdog"), { recursive: true });

35mkdirSync(join(tmp, "bin"), { recursive: true });

37let passed = 0,

38 failed = 0;

39function check(name, cond, detail = "") {

40 if (cond) {

41 passed++;

42 console.log(` ✅ ${name}`);

43 } else {

44 failed++;

45 console.log(` ❌ ${name} ${detail}`);

46 }

47}

49// ── 准备假全局包 ──

50writeFileSync(

•matchType = previous_version_dangerous_delta matchedPackage = tt-help-cli-ycl@1.4.48 matchedIdentity = npm:dHQtaGVscC1jbGkteWNs:1.4.48 similarity = 0.795 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/test-upgrade-spawn.mjsView on unpkg

src/lib/scroll-collector.jsView file

Lines 11-51javascript

11 if (!containerSelector) {

12 el = window;

13 } else {

14 el = document.querySelector(containerSelector);

15 if (!el) {

src/watchdog/upgrader.jsView file

Lines 1-28javascript

1/**

2 * 自动升级模块 — 检测 tt-help-cli-ycl 新版本并执行升级

3 *

4 * 仅全局安装模式启用。每 10 分钟查询 npm registry 发现新版本，

5 * 由旧 watchdog spawn 独立升级进程 U：U 负责「下载 → 验证版本 → 杀旧 → 启新」，

6 * 见 runUpgradeMode。旧 watchdog 收到 SIGTERM 后优雅退出，新版接管。

7 */

9import { exec, spawn, execFile } from "child_process";

scripts/run-explore.shView file

•path = scripts/run-explore.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/run-explore.shView on unpkg

Source & flagged code

7 flagged · loading source

scripts/test-upgrade-spawn.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code