yuanflow-cli@0.1.89: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 110 file(s), 1.05 MB of source, external domains: 127.0.0.1, cdn.jsdelivr.net, codeload.github.com, example.com, github.com, open.yuanchuangai.com, v.douyin.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-37json

2 "name": "yuanflow-cli",

3 "version": "0.1.89",

4 "description": "YuanFlow 自媒体 API CLI 与 Skill 安装器。",

5 "type": "module",

6 "license": "MIT",

7 "private": false,

8 "author": "zktlove",

9 "publishConfig": {

10 "access": "public"

11 },

12 "bin": {

13 "yuanflow-cli": "bin/yuanflow-cli.js",

14 "yuanflow-skill": "bin/yuanflow-skill.cjs"

15 },

16 "scripts": {

17 "postinstall": "node ./bin/yuanflow-skill.cjs install --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "generate": "node ./scripts/generate-registry.js",

19 "start": "node ./bin/yuanflow-cli.js",

20 "test": "node --test test/*.test.js tests/*.test.cjs",

21 "pack:check": "npm pack --dry-run",

22 "release:check": "node ./bin/yuanflow-skill.cjs release-check",

23 "publish:help": "node ./bin/yuanflow-skill.cjs publish-help"

24 },

25 "files": [

26 "bin",

27 "src",

28 "generated",

29 "scripts",

30 "lib",

31 "skills",

32 "README.md",

33 "LICENSE"

34 ],

35 "repository": {

36 "type": "git",

37 "url": "git+https://github.com/zktlove/yuanflow-cli.git"

bin/yuanflow-skill.cjsView file

Lines 1-24javascript

1#!/usr/bin/env node

3const fs = require('node:fs');

4const path = require('node:path');

5const {

src/video/doctor.jsView file

Lines 98-138javascript

98 const metadataText = await metadataResponse.text();

99 const metadata = parseMaybeJson(metadataText);

100 if (!metadataResponse.ok) {

src/video/recorder.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync } from 'node:fs';

3import { createServer } from 'node:http';

4import { mkdir, readFile, writeFile } from 'node:fs/promises';

skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.pyView file

•path = skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.py kind = build_helper sizeBytes = 459 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.pyView on unpkg

skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.pyView file

•path = skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.py kind = payload_in_excluded_dir sizeBytes = 8030 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.pyView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

yuanflow-cli@0.1.89: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged

package.jsonView file

Lines 1-37json

2 "name": "yuanflow-cli",

3 "version": "0.1.89",

4 "description": "YuanFlow 自媒体 API CLI 与 Skill 安装器。",

5 "type": "module",

6 "license": "MIT",

7 "private": false,

8 "author": "zktlove",

9 "publishConfig": {

10 "access": "public"

11 },

12 "bin": {

13 "yuanflow-cli": "bin/yuanflow-cli.js",

14 "yuanflow-skill": "bin/yuanflow-skill.cjs"

15 },

16 "scripts": {

17 "postinstall": "node ./bin/yuanflow-skill.cjs install --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "generate": "node ./scripts/generate-registry.js",

19 "start": "node ./bin/yuanflow-cli.js",

20 "test": "node --test test/*.test.js tests/*.test.cjs",

21 "pack:check": "npm pack --dry-run",

22 "release:check": "node ./bin/yuanflow-skill.cjs release-check",

23 "publish:help": "node ./bin/yuanflow-skill.cjs publish-help"

24 },

25 "files": [

26 "bin",

27 "src",

28 "generated",

29 "scripts",

30 "lib",

31 "skills",

32 "README.md",

33 "LICENSE"

34 ],

35 "repository": {

36 "type": "git",

37 "url": "git+https://github.com/zktlove/yuanflow-cli.git"

bin/yuanflow-skill.cjsView file

Lines 1-24javascript

1#!/usr/bin/env node

3const fs = require('node:fs');

4const path = require('node:path');

5const {

src/video/doctor.jsView file

Lines 98-138javascript

98 const metadataText = await metadataResponse.text();

99 const metadata = parseMaybeJson(metadataText);

100 if (!metadataResponse.ok) {

src/video/recorder.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync } from 'node:fs';

3import { createServer } from 'node:http';

4import { mkdir, readFile, writeFile } from 'node:fs/promises';

skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.pyView file

•path = skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.py kind = build_helper sizeBytes = 459 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/yuanflow-skill/PPT制作/scripts/svg_to_pptx.pyView on unpkg

skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.pyView file

•path = skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.py kind = payload_in_excluded_dir sizeBytes = 8030 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/yuanflow-skill/公众号生成与发布/tests/test_wechat_draft.pyView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code