@keruyun/agent-cli@1.15.1
客如云 CLI 工具
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe postinstall hook automatically discloses identifying machine and user data to a fixed endpoint without affirmative installer consent. This verified install-time disclosure supports blocking publication.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Package installation runs the postinstall hook.
Impact
Installation discloses identifying information to the endpoint operator.
Mechanism
The installer gathers hostname, a user ID parsed from AGENT_WORK_ROOT, and REWIND_SESSION_ID, then posts the report to a fixed endpoint; tracking is enabled unless explicitly disabled through an environment variable.
Attack narrative
On installation, the postinstall script sends a report to a fixed logging endpoint. The report can include the machine hostname, a user ID parsed from AGENT_WORK_ROOT, and REWIND_SESSION_ID. Tracking runs by default and has only an environment-variable opt-out.
AI rationale
The postinstall hook automatically discloses identifying machine and user data to a fixed endpoint without affirmative installer consent. This verified install-time disclosure supports blocking publication.
Evidence
package.jsoninstall.cjs
Network endpoints1
tnnm-alsc-saas-merchant-spider-fy21.cn-wulanchabu.log.aliyuncs.com
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs install.cjs automatically through its postinstall hook.
- The installer sends a POST to a fixed logging endpoint without credentials.
- The report includes the machine hostname, a user ID derived from AGENT_WORK_ROOT, and a session ID from the environment.
- Tracking is enabled by default; it runs after the install outcome and is disabled only by an environment variable.
Evidence against
- The installer also downloads a platform binary and checks its hashes before writing it; this does not prevent the separate tracking request.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/sdk.mjsView file
1var Mm=Object.create;var gi=Object.defineProperty;var Jm=Object.getOwnPropertyDescriptor;var Vm=Object.getOwnPropertyNames;var Bm=Object.getPrototypeOf,Wm=Object.prototype.hasOwnPr...
L2: `;quote='"';escape=this.quote;quoteColumns=!1;quoteHeaders=this.quoteColumns;headers=null;includeEndRowDelimiter=!1;transform;shouldWriteHeaders;writeBOM=!1;escapedQuote;BOM="\uFEF...
L3: ]`;this.ESCAPE_REGEXP=new RegExp(i)}set headers(r){this._headers=r}shouldQuote(r,i){let o=i?this.formatterOptions.quoteHeaders:this.formatterOptions.quoteColumns;return typeof o=="...
L4: `)}var it=e=>(r,i,o,t)=>{let n=o?{...o,async:!1}:{async:!1},a=r._zod.run({value:i,issues:[]},n);if(a instanceof Promise)throw new he;if(a.issues.length){let c=new(t?.Err??e)(a.issu...
...
L66:
L67: Set the \`cycles\` parameter to \
Findings
1 Critical5 High6 Medium4 Low
CriticalRemote Response Code Executionbin/sdk.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighEval
HighObfuscated Payload Loaderbin/sdk.mjs
HighInstall Named Payload Fileinstall.cjs
HighKnown Malware Source Similarityinstall.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarybin/kry-cli.exe
MediumShips Build Helperbin/log.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @keruyun/agent-cli@1.15.1.
See all versions of @keruyun/agent-cli for other recorded verdicts.
- Avoid installing @keruyun/agent-cli@1.15.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.