Loading npm security reports…

@lijuneleven/iris@0.2.29: AI-agent control-surface risk | LPM Firewall

registry / @lijuneleven/iris / 0.2.29

@lijuneleven/iris@0.2.29

Feishu-first personal AI assistant powered by local Agents.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall copies or downloads a native iris binary and immediately runs it with --install-agent-hooks. The package says that step writes Codex notify hooks, Claude Code Stop hooks, and Feishu-context skills into those agents.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install, via the postinstall script

Impact

Foreign Codex and Claude Code hook and skill control surfaces can be changed without a separate user command, and an opaque native binary runs during install.

Mechanism

unconsented postinstall native binary agent-hook installer

Policy narrative

On npm install, postinstall runs scripts/install.js. That script copies a bundled native binary, or downloads one from GitHub or Gitee while following HTTP redirects, into vendor/iris and then executes it with --install-agent-hooks. The package states this writes Codex notify hooks, Claude Code Stop hooks, and Feishu-context skills into both agents, and that the CLI retries the same setup on every service start. The vendor binaries are not readable as source, so install-time execution can change foreign agent control surfaces without a separate user command.

AI rationale

Automatic postinstall execution of a native binary with --install-agent-hooks, together with the package's own statement that this writes Codex and Claude Code hooks and skills, is unconsented mutation of a foreign AI-agent control surface. That meets the publish-block rule even though the JS wrapper itself does not steal credentials.

Evidence

package.jsonscripts/install.jsREADME.mdvendor/irisvendor/iris.exe

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/iris.jsView file

4const path = require("path"); L5: const { spawn } = require("child_process"); L6:

High

Child Process

Package source references child process execution.

bin/iris.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @lijuneleven/iris@0.2.114 matchedPath = bin/iris.js matchedIdentity = npm:QGxpanVuZWxldmVuL2lyaXM:0.2.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/iris.jsView on unpkg

scripts/install.jsView file

4const path = require("path"); L5: const http = require("http"); L6: const https = require("https"); L7: const { spawn } = require("child_process"); L8: const { pipeline } = require("stream/promises"); ... L12: L13: const owner = process.env.IRIS_GITHUB_OWNER || process.env.EASY_TERMINAL_GITHUB_OWNER || "elevenlj"; L14: const repo = process.env.IRIS_GITHUB_REPO || process.env.EASY_TERMINAL_GITHUB_REPO || "iris";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L4

4const path = require("path"); L5: const http = require("http"); L6: const https = require("https"); L7: const { spawn } = require("child_process"); L8: const { pipeline } = require("stream/promises"); ... L10: L11: const packageJson = require("../package.json"); L12: L13: const owner = process.env.IRIS_GITHUB_OWNER || process.env.EASY_TERMINAL_GITHUB_OWNER || "elevenlj"; L14: const repo = process.env.IRIS_GITHUB_REPO || process.env.EASY_TERMINAL_GITHUB_REPO || "iris"; ... L16: const version = packageJson.version; L17: const platform = process.platform;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/install.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @lijuneleven/iris@0.2.114 matchedPath = scripts/install.js matchedIdentity = npm:QGxpanVuZWxldmVuL2lyaXM:0.2.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

vendor/iris-linux-amd64View file

•path = vendor/iris-linux-amd64 kind = native_binary sizeBytes = 13893816 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/iris-linux-amd64View on unpkg

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/iris.jsView file

4const path = require("path"); L5: const { spawn } = require("child_process"); L6:

High

Child Process

Package source references child process execution.

bin/iris.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @lijuneleven/iris@0.2.114 matchedPath = bin/iris.js matchedIdentity = npm:QGxpanVuZWxldmVuL2lyaXM:0.2.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/iris.jsView on unpkg

scripts/install.jsView file

4const path = require("path"); L5: const http = require("http"); L6: const https = require("https"); L7: const { spawn } = require("child_process"); L8: const { pipeline } = require("stream/promises"); ... L12: L13: const owner = process.env.IRIS_GITHUB_OWNER || process.env.EASY_TERMINAL_GITHUB_OWNER || "elevenlj"; L14: const repo = process.env.IRIS_GITHUB_REPO || process.env.EASY_TERMINAL_GITHUB_REPO || "iris";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L4

4const path = require("path"); L5: const http = require("http"); L6: const https = require("https"); L7: const { spawn } = require("child_process"); L8: const { pipeline } = require("stream/promises"); ... L10: L11: const packageJson = require("../package.json"); L12: L13: const owner = process.env.IRIS_GITHUB_OWNER || process.env.EASY_TERMINAL_GITHUB_OWNER || "elevenlj"; L14: const repo = process.env.IRIS_GITHUB_REPO || process.env.EASY_TERMINAL_GITHUB_REPO || "iris"; ... L16: const version = packageJson.version; L17: const platform = process.platform;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/install.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @lijuneleven/iris@0.2.114 matchedPath = scripts/install.js matchedIdentity = npm:QGxpanVuZWxldmVuL2lyaXM:0.2.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

vendor/iris-linux-amd64View file

•path = vendor/iris-linux-amd64 kind = native_binary sizeBytes = 13893816 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/iris-linux-amd64View on unpkg