registry / @g7e6-sdlc/sdlc-cli / 1.5.4

@g7e6-sdlc/sdlc-cli@1.5.4

SDLC 最小集 CLI（sdlc-cli）— 本地即真源的中间产物仓库与工作区装配

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Installing the package automatically overwrites bundled skills into Claude and generic agent skill directories. This changes broad AI-agent control surfaces without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm runs the package postinstall lifecycle hook.

Impact

Existing agent skills with matching names can be replaced and future agent behavior can be influenced by package-supplied instructions.

Mechanism

The hook runs the install command, which calls installSkills; that routine removes each destination and copies the package's bundled skill directory into it.

Attack narrative

A normal dependency installation triggers `sdlc-cli install`. The command automatically targets both `~/.claude/skills` and `~/.agents/skills`, removes matching existing directories, and copies bundled skills there. This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces.

AI rationale

The lifecycle hook directly activates destructive replacement of user-level AI-agent skills. This meets the install-control-surface blocking policy regardless of the package's other CLI functions.

Evidence

package.jsondist/cli.js~/.claude/skills~/.agents/skills

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package automatically invokes its install command during postinstall.
The install command selects Claude and generic agent skill directories under the user's home directory.
It deletes an existing skill directory and replaces it with bundled package content.
The install command calls the skill installation routine without user interaction.

Evidence against

The separate global npm installation path is disabled when the process is running in postinstall.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 393 KB of source, external domains: apollo-api.demo.chinawayltd.com, apollo-api.dev.chinawayltd.com, apollo-api.test.chinawayltd.com, apollo.merak.chinawayltd.com, archery.chinawayltd.com, devcloud.chinawayltd.com, devlake.chinawayltd.com, devlake.example.com, issues.chinawayltd.com, jira.example.com, sdlc-knowledge-base.g7in.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-38json

2 "name": "@g7e6-sdlc/sdlc-cli",

3 "version": "1.5.4",

4 "description": "SDLC 最小集 CLI（sdlc-cli）— 本地即真源的中间产物仓库与工作区装配",

5 "type": "module",

6 "bin": {

7 "sdlc-cli": "./dist/cli.js"

8 },

9 "files": [

10 "dist",

11 "skills"

12 ],

13 "engines": {

14 "node": ">=20"

15 },

16 "scripts": {

17 "build": "tsup",

18 "postinstall": "node ./dist/cli.js install || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "dev": "tsup --watch",

20 "test": "vitest run",

21 "test:watch": "vitest",

22 "migrate:prd-modules": "tsx scripts/migrate-prd-modules.ts",

23 "typecheck": "tsc --noEmit"

24 },

25 "dependencies": {

26 "clipanion": "^4.0.0-rc.4",

27 "fast-glob": "^3.3.2",

28 "gray-matter": "^4.0.3",

29 "ioredis": "^6.0.0",

30 "mysql2": "^3.24.4",

31 "simple-git": "^3.27.0",

32 "yaml": "^2.6.1",

33 "zod": "^3.24.1"

34 },

35 "devDependencies": {

36 "@types/node": "^22.10.5",

37 "tsup": "^8.3.5",

38 "tsx": "4.19.2",

dist/cli.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res) => function __init() {

skills/initializing-context-repo/scripts/init_context_repo.pyView file

•path = skills/initializing-context-repo/scripts/init_context_repo.py kind = build_helper sizeBytes = 16678 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/initializing-context-repo/scripts/init_context_repo.pyView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/cli.js install || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/cli.js install || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

634var DEFAULT_SESSION_EXCLUDE = [ L635: "~/.claude/**", L636: "~/.codex/**", L637: "~/.ssh/**", ... L650: function defaultClaudeHome() { L651: return join(homedir(), ".claude"); L652: } L653: function defaultCodexHome() { L654: const fromEnv = process.env.CODEX_HOME?.trim(); L655: return fromEnv ? fromEnv : join(homedir(), ".codex"); L656: } ... L717: import {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli.jsView on unpkg · L634

•matchType = normalized_sha256 matchedPackage = @g7e6-sdlc/sdlc-cli@1.5.2 matchedPath = dist/cli.js matchedIdentity = npm:QGc3ZTYtc2RsYy9zZGxjLWNsaQ:1.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = f3c2e392491470ae signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @g7e6-sdlc/sdlc-cli@1.5.2 matchedPath = dist/cli.js matchedIdentity = npm:QGc3ZTYtc2RsYy9zZGxjLWNsaQ:1.5.2 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.jsView on unpkg

13function businessError(message, details) { L14: return new CtxError(ExitCode.Business, message, details); L15: } ... L237: headers: { Authorization: `AK ${spec.archery.accessKey}`, "Content-Type": "application/json" }, L238: body: JSON.stringify({ instance_name: spec.connection.instance, db_name: spec.connection.database, sql, limit: MAX_RESULT_ITEMS + 1 }), L239: signal L240: }); L241: const text = await response.text(); L242: let body; ... L616: var DEFAULT_APOLLO_SERVERS = { L617: dev: "http://apollo-api.dev.chinawayltd.com:8080", L618: test: "http://apollo-api.test.chinawayltd.com:8080",

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L13

skills/initializing-context-repo/scripts/init_context_repo.pyView file

•path = skills/initializing-context-repo/scripts/init_context_repo.py kind = build_helper sizeBytes = 16678 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/initializing-context-repo/scripts/init_context_repo.pyView on unpkg

Findings

1 Critical3 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Fingerprint Signaturedist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/initializing-context-repo/scripts/init_context_repo.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/cli.js

LowFilesystem

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @g7e6-sdlc/sdlc-cli@1.5.4.

See version security history for other recorded verdicts.

Avoid installing @g7e6-sdlc/sdlc-cli@1.5.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-20 19:54:06.184Z (UTC).