Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@keruyun/agent-cli@1.4.11: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 13 finding(s) warrant review before installing.

View on npm All versions

registry / @keruyun/agent-cli / 1.4.11

@keruyun/agent-cli@1.4.11

客如云 CLI 工具

AI Security Review

scanned 20d ago · by lpm-firewall-ai

npm postinstall downloads a hashed native CLI and writes it into the package bin directory. It also sends installation telemetry; importing the SDK sends additional locally derived usage telemetry.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install for postinstall; importing bin/sdk.mjs for SDK telemetry

Impact

A remote native payload is staged for later CLI use, while host/session and SDK-derived metadata are transmitted.

Mechanism

hashed remote binary staging plus telemetry POSTs

Rationale

This is a documented package-owned binary bootstrapper with integrity pinning, not confirmed malware. The uninspectable staged executable and automatic telemetry create a material unresolved supply-chain/privacy risk.

Evidence

package.jsoninstall.cjsbinaries.jsonbin/sdk.mjsREADME.mdbin/kry-cli.exe

Network endpoints2

s.koubei.com/tnnm-alsc-saas-merchant-spider-fy21.cn-wulanchabu.log.aliyuncs.com/logstores/kry-cli/track?APIVersion=0.6.0

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs postinstall via install.cjs.
install.cjs downloads platform binaries from s.koubei.com and replaces bin/kry-cli.exe.
Downloaded executable is not source-inspectable in this package.
install.cjs silently POSTs install telemetry including hostname, session/user-derived fields, and npm metadata.
bin/sdk.mjs imports local token/org data and sends derived identity and command-path telemetry on SDK initialization.

Evidence against

binaries.json pins per-platform compressed and decompressed SHA-256 hashes.
install.cjs verifies hashes before writing the downloaded binary.
Lifecycle writes only the package-owned bin/kry-cli.exe; no broad agent-config mutation found.
No credential values, shell payload execution, eval, or destructive filesystem behavior found.
README.md documents the shell-package CDN installation design.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 30.9 KB of source, external domains: gitlab.alibaba-inc.com, gldopen.keruyun.com, gldopenapi.keruyun.com, open.keruyun.com, openapi.keruyun.com, preopen.tongyun0815.com, preopenapi.tongyun0815.com, tnnm-alsc-saas-merchant-spider-fy21.cn-wulanchabu.log.aliyuncs.com

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.cjsView file

28* L29: * 首装曾是唯一一段完全没有观测的路径：下面那 8 条返回路径以前只写 stderr，而 npm 通常把 L30: * postinstall 的 stderr 折叠掉 —— 于是「有多少人装不上、卡在下载还是校验、哪个平台最惨」 ... L50: const zlib = require('zlib'); L51: const { execFileSync } = require('child_process'); L52: L53: const BIN_DIR = path.join(__dirname, 'bin'); L54: const TARGET = path.join(BIN_DIR, 'kry-cli.exe'); ... L65: function log(msg) { L66: process.stdout.write(`${LOG_PREFIX} ${msg}\n`); L67: } ... L73: try {

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

install.cjsView on unpkg · L28

•matchType = previous_version_dangerous_delta matchedPackage = @keruyun/agent-cli@1.4.6 matchedIdentity = npm:QGtlcnV5dW4vYWdlbnQtY2xp:1.4.6 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install.cjsView on unpkg

bin/kry-cli.exeView file

•path = bin/kry-cli.exe kind = native_binary sizeBytes = 1356 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/kry-cli.exeView on unpkg

bin/log.pyView file

•path = bin/log.py kind = build_helper sizeBytes = 10484 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/log.pyView on unpkg

Findings

3 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighInstall Named Payload Fileinstall.cjs

HighPrevious Version Dangerous Deltainstall.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/kry-cli.exe

MediumShips Build Helperbin/log.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeStaged Payload Carrier

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Author玄宫

Maintainerskeruyun

Version1.4.15

PublishedAug 11, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size18.9 KB

Files7

LinksRepository

Runtime surface

package.json

Entrypointsexports mapbin → krycli

Runtimenode >=18

Artifact45.9 KB · 7 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkHighEntropyStringsMinifiedUrlStringsManifest: clean

LPM CLI

Source & flagged code

6 flagged

package.jsonView file

Lines 7-33json

7 "keywords": [],

8 "repository": {

9 "type": "git",

10 "url": "http://gitlab.alibaba-inc.com/alsc-kry-open/krycli.git"

11 },

12 "bin": {

13 "krycli": "bin/kry-cli.exe"

14 },

15 "exports": {

16 "/sdk": {

17 "types": "./bin/sdk.mjs",

18 "import": "./bin/sdk.mjs"

19 }

20 },

21 "files": [

22 "bin",

23 "install.cjs",

24 "binaries.json"

25 ],

26 "scripts": {

27 "postinstall": "node install.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 },

29 "engines": {

30 "node": ">=18"

31 }

32}

33

install.cjsView file

Lines 8-48javascript

8 * ├── bin/sdk.mjs SDK 仍是 ESM，二进制替代不了

9 * ├── install.cjs ← 本文件

10 * └── binaries.json 每平台 { url, sha256(解压后), brSha256, brBytes, bytes }

11 *

12 * 二进制以 brotli 压缩件（.br）存放在客如云

bin/kry-cli.exeView file

•path = bin/kry-cli.exe kind = native_binary sizeBytes = 1356 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/kry-cli.exeView on unpkg

bin/log.pyView file

•path = bin/log.py kind = build_helper sizeBytes = 10484 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/log.pyView on unpkg

CDN

（s.koubei.com），

URL

由发布时上传后写死进

13 * binaries.json —— fileId 随机颁发、URL 不可变，同一版本的链接永远指向同一份字节。

14 * 本脚本按平台挑 URL，下载 → sha256 校验 → 解压 → 放置。

15 *

16 * 之前的做法是 6 个平台包挂在 optionalDependencies 上由 npm 分发。放弃它是因为发布要

17 * 串行 publish 12 个 25~39 MB 的包，慢到不可接受；CDN 方案每通道只发 1 个壳包。

18 *

19 * 三个容易踩的细节（选型文档 §6）：

20 * 1. musl 检测读 process.report.getReport().header.glibcVersionRuntime，

21 * 不要 spawn `ldd` —— ldd 不在 PATH 时会误判。

22 * 2. Rosetta 纠正：x64 Node 跑在 Apple Silicon 上时 os.arch() 返回 x64，

23 * 但 x64 构建需要 AVX 而 Rosetta 不模拟，装上去直接 SIGILL。查 sysctl.proc_translated。

24 * 3. 目标文件名固定 kry-cli.exe：.exe 后缀 + 无 shebang，让 npm 的 cmd-shim 在

25 * Windows 上直接 exec；Unix 忽略后缀。

26 *

27 * ## 埋点（2026-08）

28 *

29 * 首装曾是唯一一段完全没有观测的路径：下面那 8 条返回路径以前只写 stderr，而 npm 通常把

30 * postinstall 的 stderr 折叠掉 —— 于是「有多少人装不上、卡在下载还是校验、哪个平台最惨」

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

install.cjsView on unpkg · L28

31 * 一个都答不出来。现在每条路径都上报一条，logstore 与 CLI 侧同一个（自升级已经在报了，

32 * 见 `src/core/update.ts`），拼起来才是完整的装机图。

33 *

34 * 三条硬约束：

35 * 1. **埋点失败绝不影响安装结果** —— 全程吞异常，返回码只由安装本身决定。

36 * 2. **不打印任何东西** —— `release:verify` 有断言盯着 postinstall 的输出。

37 * 3. **必须 await** —— 本文件结尾是 `process.exit(code)`，fire-and-forget 的 fetch 会被

38 * 直接掐掉、一条都发不出去。代价是安装最多多等 TRACK_TIMEOUT_MS（5 秒，见那个常量）。

39 *

40 * 两个开关：`KRY_CLI_NO_TRACK=1` 整体关掉（CI、离线环境、端到端验证用）；

41 * `KRY_CLI_TRACK_DEBUG=1` 把上报的 HTTP 状态或失败原因打到 stderr（默认一个字都不打）。

42 */

43

44'use strict';

45

46const fs = require('fs');

47const os = require('os');

48const path = require('path');

•matchType = previous_version_dangerous_delta matchedPackage = @keruyun/agent-cli@1.4.6 matchedIdentity = npm:QGtlcnV5dW4vYWdlbnQtY2xp:1.4.6 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install.cjsView on unpkg