registry / @keruyun/agent-cli / 1.5.4

@keruyun/agent-cli@1.5.4

客如云 CLI 工具

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing the package silently exfiltrates installation and agent-context identifiers. It also replaces the CLI executable with a remotely downloaded opaque payload.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation activates postinstall.

Impact

A remote service receives host and agent-context metadata; a large opaque executable is installed for later use.

Mechanism

Postinstall telemetry plus verified remote binary staging.

Attack narrative

On npm installation, the package runs install.cjs. It derives a user identifier from AGENT_WORK_ROOT, reads REWIND_SESSION_ID, collects the host name and npm metadata, and POSTs them to a remote log endpoint while suppressing errors. The same hook downloads a platform-specific compressed payload from a CDN, decompresses it, and replaces bin/kry-cli.exe. Although hashes are pinned, the executable content is not auditable in the package and the telemetry is automatic.

AI rationale

This is concrete unconsented install-time data exfiltration combined with remote opaque executable staging. Hash validation limits transit tampering but does not make the automatic collection or remote payload benign.

Evidence

package.jsoninstall.cjsbinaries.jsonbin/kry-cli.exe

Network endpoints2

s.koubei.com/dcCBzyTxt7kxC4icSymEsjwJJWKczrj6.br/logstores/kry-cli/track?APIVersion=0.6.0

@keruyun/agent-cli@1.5.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code