registry / @lijuneleven/iris / 0.2.48

@lijuneleven/iris@0.2.48

Feishu-first personal AI assistant powered by local Agents.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installation automatically obtains or uses a native executable and runs it to install Codex and Claude Code hooks. This mutates foreign AI-agent control surfaces without an explicit user command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

The executable can persist package-controlled behavior in Codex and Claude Code hook configuration.

Mechanism

Remote or bundled native binary installs AI-agent completion hooks.

Attack narrative

On package installation, npm invokes scripts/install.js. The script selects a bundled executable or downloads one from GitHub or Gitee, writes it under vendor, then executes it with --install-agent-hooks. The package states that this installs Codex notify and Claude Code Stop hooks and retries setup on later launches. This is an unconsented lifecycle mutation of foreign AI-agent control surfaces, while the payload is opaque native code and downloaded releases are not integrity-verified.

AI rationale

This is a concrete postinstall chain that installs a native payload and uses it to alter third-party AI-agent hooks. The behavior meets the install-hook abuse block policy despite package-aligned download hosts.

Evidence

package.jsonscripts/install.jsREADME.mdvendor/iris

Network endpoints2

github.comgitee.com

@lijuneleven/iris@0.2.48

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code