Jev 分類在 Hemanth.HM 的 pkg-gate 閘控 npm install 腳本

護欄

分類這個使用案例

問 Jev 這個 npm 生命週期腳本的 intent Choice、threat Score、secret Noul 和 remote-exec Noul。

Name: script_intent
指示: What is the primary intent and runtime behavior of `script_content` executed in lifecycle hook `lifecycle_hook`?
準則: build_tool
Standard compilation or native build (e.g. node-gyp, esbuild, tsc, cargo)
binary_download
Downloads official pre-compiled native binaries or assets from a known repository or CDN
benign_notice
Informational message, donation banner, or benign no-op command
system_recon
Gathers host system details, environment variables, network interfaces, or user directories
credential_access
Reads or extracts secrets, authentication tokens (NPM_TOKEN, AWS, SSH keys), or credential files
obfuscated_exec
Executes obfuscated code, base64 payloads, or pipes curl/wget to bash/sh/node
other
General package maintenance or utility task

Name: threat_severity
指示: How severe is the security risk of executing `script_content` during npm install of `package.name`?
準則: 0
Safe: standard build or benign command with no external network or secret access
1
Low risk: fetches known binary from release domain or routine package setup
2
Suspicious: makes non-standard outbound connections, inspects system environment, or runs encoded commands
3
Critical threat: credential harvesting, token exfiltration, backdoor dropper, or destructive action

Name: accesses_secrets
指示: Does `script_content` attempt to access, extract, or transmit environment variables, private credentials, or authentication tokens?

Name: remote_execution
指示: Does `script_content` download and execute arbitrary unverified external code or pipe remote scripts directly into a shell?