registry / @lijuneleven/iris / 0.2.128

@lijuneleven/iris@0.2.128

Feishu-first personal AI assistant powered by local Agents.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically executes native agent integration setup. This creates unresolved agent lifecycle risk, but inspected source does not establish unconsented broad agent configuration mutation or another confirmed attack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall runs scripts/install.js.

Impact

Agent integration setup runs with the installing user's environment and permissions; its exact configuration changes remain unverified.

Mechanism

The installer copies or downloads a platform executable and runs it with --install-agent-hooks.

AI rationale

Automatic native agent hook setup warrants a warning because its configuration mutations cannot be verified from the available readable source. No inspected executable source proves a block-eligible attack.

Evidence

package.jsonscripts/install.js

Network endpoints2

github.com/${owner}/${repo}/releases/download/v${version}/${assetName}gitee.com/${giteeRepo}/releases/download/v${version}/${assetName}

Decision evidence

public snapshot

@lijuneleven/iris@0.2.128

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code