aicoin-trading

SUSPICIOUS：技能目的与交易能力总体一致，且来源看似同组织官方，但它赋予代理真实交易权限，并要求把高价值交易所凭据交给未展示的本地脚本处理与本地持久化。未见明确恶意或外部钓鱼端点证据，因此不判定为 MALICIOUS；但基于高后果自治操作、凭据转发和不可验证的数据流，整体风险偏高。

The fragment is a cryptocurrency exchange management and trading CLI. It contains explicit high-impact capabilities and handles API keys and private keys, but there is no clear evidence of malware, covert credential harvesting, system-data exfiltration, persistence, or sabotage. The main security concerns are automatic npm installation, direct secret-file interpolation, weak pending-file protections, the AICOIN_INTERNAL_CALL confirmation bypass, and unconfirmed fund transfers. Referral and broker identifiers are unusual but appear to be disclosed affiliate functionality. Review and harden credential serialization, file permissions and atomicity, confirmation/authentication controls, and dependency installation before production use.

The code is a trading CLI with intentional filesystem access, child-process execution, and exchange order placement. It presents significant financial and operational risk because user-controlled configuration reaches leveraged trading actions and protective orders may fail after the entry order succeeds. No evidence of malware, credential theft, network exfiltration, obfuscation, or unauthorized persistence is present in the supplied fragment. Review exchange.mjs and validate configuration and order responses before use.

The fragment contains hardcoded API credentials, which is a security and supply-chain exposure but not evidence of malware by itself. No malicious behavior or executable attack path is present in this JSON alone. The credentials should be revoked or rotated and removed from distributed artifacts.