registry / @lijuneleven/iris / 0.2.121

@lijuneleven/iris@0.2.121

Feishu-first personal AI assistant powered by local Agents.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation downloads or uses a platform binary, then automatically invokes its agent-hook setup. The binary behavior is not represented as inspectable source in this package.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall during package installation.

Impact

This creates an unresolved automatic AI-agent extension lifecycle risk; no confirmed data theft or destructive action was found in the inspected JavaScript.

Mechanism

scripts/install.js installs a binary and runs it with an agent-hook installation argument.

AI rationale

The package automatically performs opaque agent-hook setup during installation, which is a concrete lifecycle risk but does not prove a foreign or broad control-surface mutation. The inspected source does not establish malware behavior.

Evidence

package.jsonscripts/install.jsvendor/irisvendor/iris.exe

Network endpoints2

github.com/${owner}/${repo}/releases/download/v${version}/${assetName}gitee.com/${giteeRepo}/releases/download/v${version}/${assetName}

@lijuneleven/iris@0.2.121

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code