Loading npm security reports…

@aswless_854771076/ai_short_studio_cli@0.1.46: AI-agent | LPM Firewall

registry / @aswless_854771076/ai_short_studio_cli / 0.1.46

@aswless_854771076/ai_short_studio_cli@0.1.46

VVICAT 无限画布项目命令行工具

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates Codex's shared skill control surface by copying bundled agent skills into ~/.codex/skills. This occurs automatically on dependency installation and can change future agent behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation executes postinstall.

Impact

Unconsented persistence of package-controlled instructions in a broad AI-agent control surface.

Mechanism

automatic installation of bundled agent skills into the Codex skills directory

Policy narrative

Installing the package invokes postinstall, which defaults to copying three package-supplied skills into ~/.codex/skills. Those persisted instructions are automatically discoverable by Codex and include mandatory workflow behavior, including default global CLI updating. The mutation is not gated on an explicit skill-install command or user consent.

Rationale

This is a concrete unconsented postinstall write to a broad AI-agent control surface. Runtime authentication and network features do not mitigate that install-time persistence.

Evidence

package.jsonscripts/postinstall.mjsdist/skill/skill-manager.jsskills/using-vvicat-ai-short-studio-cli/SKILL.md~/.codex/skills/using-vvicat-ai-short-studio-cli~/.codex/skills/short-drama~/.codex/skills/humanizer

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/skill/skill-manager.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L12: export function defaultSkillsRoot(target) { L13: return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills'); L14: } ... L41: const backup = `${target}.backup-${process.pid}`; L42: await mkdir(dirname(target), { recursive: true }); L43: await rm(temporary, { recursive: true, force: true }); L44: await cp(bundledSkillPath(name), temporary, { recursive: true }); L45: await writeFile(join(temporary, MANIFEST), `${JSON.stringify({ packageVersion, checksum }, null, 2)}\n`, 'utf8'); Write operation from dist/skill/sk[redacted]: L12: export function defaultSkillsRoot(target) { L13: return join(homedir(), target === 'codex' ? '.codex' : '.agents', 'skills'); L14: } ... L41: const backup = `${target}.backup-

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/skill/skill-manager.jsView on unpkg · L1

dist/auth/google-oauth.jsView file

•matchType = normalized_sha256 matchedPackage = @aswless_854771076/ai_short_studio_cli@0.1.45 matchedPath = dist/auth/google-oauth.js matchedIdentity = npm:[redacted]:0.1.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth/google-oauth.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = c131ebf5f25e1696 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @aswless_854771076/ai_short_studio_cli@0.1.45 matchedPath = dist/auth/google-oauth.js matchedIdentity = npm:[redacted]:0.1.45 similarity = 1.000 shingleOverlap = 15 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/auth/google-oauth.jsView on unpkg

dist/preflight.jsView file

•matchType = normalized_sha256 matchedPackage = @aswless_854771076/ai_short_studio_cli@0.1.45 matchedPath = dist/preflight.js matchedIdentity = npm:[redacted]:0.1.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/preflight.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 12-52json

12 "homepage": "https://codeup.aliyun.com/685a53a7323b2da0bd60070e/vvicat-ai-short-studio",

13 "publishConfig": {

14 "access": "public"

15 },

16 "type": "module",

17 "bin": {

18 "ai-short-studio": "bin/run.js"

19 },

20 "files": [

21 "bin",

22 "dist",

23 "skills",

24 "scripts/postinstall.mjs",

25 "README.md"

26 ],

27 "engines": {

28 "node": ">=22"

29 },

30 "scripts": {

31 "build": "node scripts/clean.mjs && tsc -p tsconfig.json",

32 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "prepack": "npm run build",

34 "release:dry-run": "node scripts/publish.mjs --dry-run",

35 "release:test": "node scripts/publish.mjs --name @aswless_854771076/ai_short_studio_cli --tag beta",

36 "release:ci:test": "npm test && npm run typecheck && node scripts/publish.mjs --name @aswless_854771076/ai_short_studio_cli --tag beta --verify",

37 "release:ci": "npm test && npm run typecheck && node scripts/publish.mjs --tag latest --verify",

38 "release": "node scripts/publish.mjs --tag latest",

39 "test": "vitest run",

40 "test:local-e2e": "npm run build && node scripts/local-e2e.mjs",

41 "typecheck": "tsc -p tsconfig.json --noEmit"

42 },

43 "dependencies": {

44 "@napi-rs/keyring": "^1.3.0",

45 "@oclif/core": "^4.12.0",

46 "@supabase/supabase-js": "^2.110.7"

47 },

48 "devDependencies": {

49 "@types/node": "^20.19.43",

50 "typescript": "^5.9.3",

51 "vitest": "^2.1.9"

52 },

dist/skill/skill-manager.jsView file

Lines 1-21javascript

1import { createHash } from 'node:crypto';

2import { cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';

3import { homedir } from 'node:os';

4import { basename, dirname, join, relative } from 'node:path'

dist/auth/google-oauth.jsView file

•matchType = normalized_sha256 matchedPackage = @aswless_854771076/ai_short_studio_cli@0.1.45 matchedPath = dist/auth/google-oauth.js matchedIdentity = npm:[redacted]:0.1.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth/google-oauth.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = c131ebf5f25e1696 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @aswless_854771076/ai_short_studio_cli@0.1.45 matchedPath = dist/auth/google-oauth.js matchedIdentity = npm:[redacted]:0.1.45 similarity = 1.000 shingleOverlap = 15 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/auth/google-oauth.jsView on unpkg

dist/preflight.jsView file

•matchType = normalized_sha256 matchedPackage = @aswless_854771076/ai_short_studio_cli@0.1.45 matchedPath = dist/preflight.js matchedIdentity = npm:[redacted]:0.1.45 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/preflight.jsView on unpkg