registry / u1s1-cli / 0.13.7

u1s1-cli@0.13.7

⚠ Under review

u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 1.11 MB of source, external domains: api.u1s1.io, bellard.org, github.com, reactjs.org, registry.npmjs.org, u1s1.io, www.w3.org

Source & flagged code

7 flagged

dist/shell-doctor.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/shell-doctor.jsView on unpkg · L1

3import { dirname, join } from "node:path";

4import { agentDir, agentSettingsFile } from "./config.js";

5/** System32/Sysnative 的 bash.exe 是 WSL 转发器,不是真 bash(与 pi 同款判断)。 */

6function isWslRelayBash(p) {

7 const normalized = p.replace(/\//g, "\\").toLowerCase();

8 return /^[a-z]:\\windows\\(?:system32|sysnative)\\bash\.exe$/.test(normalized);

10/** 异步跑子进程收 stdout;超时杀掉。任何失败都归为 ok=false,不抛。 */

11function runCapture(cmd, args, opts) {

12 return new Promise((resolve) => {

13 let done = false;

14 let timer;

15 const finish = (ok, stdout) => {

16 if (done)

17 return;

18 done = true;

19 if (timer)

20 clearTimeout(timer);

21 resolve({ ok, stdout });

Lines 105-145javascript

105 }

106 }

107 return out;

108}

109/** 持久化写 settings.json:写入时现读现改,避免覆盖并行流程刚写的其他键。 */

110function persistShellPath(p) {

111 let settings = {};

112 if (existsSync

dist/web.jsView file

Lines 1-30javascript

1import { spawn, spawnSync } from "node:child_process";

2import { mkdirSync } from "node:fs";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/web.jsView on unpkg · L1

3import { createRequire } from "node:module";

dist/update.jsView file

Lines 1-21javascript

1import { execSync, spawnSync } from "node:child_process";

2import { mkdtempSync, writeFileSync } from "node:fs";

3import { createRequire } from "node:module";

4import { tmpdir } from "node:os";

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = u1s1-cli@0.13.6 matchedIdentity = npm:dTFzMS1jbGk:0.13.6 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/shell-doctor.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code