npm JavaScript analyzed 3.5.0

chaimi-keep-mcp

v3.5.0

npm

柴米AI记账 MCP Server - 支持 Claude、Cursor、OpenClaw、WorkBuddy 等 AI 工具直接记账

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v3.5.0 · analyzer v33 · 4w ago

dynamic code execution concat require() package/server.js :2 s=require('os'),fs=require('fs'),crypto=require('crypt'+'o'),{exec}=require(_0x757ff0(0x71e)+'_proc'+'ess'),util=require(_0x757ff0(0x20f)),execPromise=util[_0x757ff0(0x3a4)+'sify'](exec);function getV

code evidence v3.5.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 14

fs package/bin/cli.js :9 const fs = require('fs');
fs package/bin/get-auth-code.js :10 const fs = require('fs');
fs package/bin/global-install.js :11 const fs = require('fs');
fs package/bin/restart-daemon.js :12 const fs = require('fs');
fs package/bin/sync-skill.js :10 const fs = require('fs');
fs package/oauth.js :1 568e3f(0x263)+'ep'};try{const _0x26cfb1=require('fs')['promi'+_0x568e3f(0x1c0)],_0x1d9025=require(_0xd007ef['WEjgZ']),_0x163763=require('os'),_0x25cb7a=_0x1d9025[_0x568e3f(0x28e)](_0x163763[_0x568e3f(
fs package/server.js :2 ath=require('path'),os=require('os'),fs=require('fs'),crypto=require('crypt'+'o'),{exec}=require(_0x757ff0(0x71e)+'_proc'+'ess'),util=require(_0x757ff0(0x20f)),execPromise=util[_0x757ff0(0x3a4)+'sify'
fs package/utils/config.js :11 const fs = require('fs').promises;
fs package/utils/keyManager.js :2 const fs = require('fs');
fs package/utils/machine-id.js :14 const fs = require('fs').promises;

shell package/bin/cli.js :11 const { spawn } = require('child_process');
shell package/bin/restart-daemon.js :10 const { exec, execSync } = require('child_process');

net package/oauth.js :1 RDkO':_0x122d8e(0x1cf)},_0x4e55ac=await fetch(this[_0x122d8e(0x227)+_0x122d8e(0x249)+'l'],{'method':_0x3ecf05[_0x122d8e(0x1e8)],'headers':{'Content-Type':_0x122d8e(0x284)+_0x122d8e(0x1b5)+'n/jso'+'n'}
net package/server.js :2 (_0x12229e,_0x26cca2,CHAIMI_API_SECRET);fetch(MCP_HUB_URL,{'method':_0x409fe1[_0x7eb7b4(0x6ff)],'headers':{'Content-Type':'appli'+_0x7eb7b4(0x33f)+_0x7eb7b4(0x81a)+'n','Authorization':_0x7eb7b4(0x793)

secrets package/server.js :2 kVersionUpgrade();let CHAIMI_API_SECRET=process.env.CHAIMI_API_SECRET;const ENV=process.env.NODE_ENV||_0x757ff0(0x85e)+_0x757ff0(0x2fc),ENCRYPTED_URLS={'development':{'hub':_0x757ff0(0x764)+_0x757ff0(
secrets package/utils/keyManager.js :11 if (process.env.MCP_SECRET_KEY) {

postinstall package/package.json :25 node bin/sync-skill.js && node bin/restart-daemon.js