yinghuo-grid@1.0.0
VERIFIEDPublisher claims: "萤火网格1.0（YingHuo Grid v1.0）——加密货币永续合约的「手工锚仓 + 马丁加仓 + ATR 间距」网格交易系统，全自动闭环执行（自动扫描接管持仓、马丁加仓、单格止盈、两档总止盈止损、趋势过滤器、仓位流水记录）。用于部署、运维或回测一套网格量化交易策略时使用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-04 and scored it 89/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
Access to sensitive file pathsscripts/manual_grid_atr.py:300 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05No other findings across 1,672 lines in 8 files.