Loading npm security reports…

@lingjingai/lj-awb-cli: AI-agent control-surface risk | LPM Firewall

registry / @lingjingai/lj-awb-cli / 0.5.18

@lingjingai/lj-awb-cli@0.5.18

Lingjing AWB CLI monorepo with shared core, standalone CLI, and agent skills

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall hook modifies AI-agent skill locations without an explicit user command. It removes existing skill directories and copies the package skill bundle into locations for several agent products.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm.

Impact

This can overwrite AI-agent control-surface content across Codex, Claude, and cc-switch installations.

Mechanism

The postinstall script selects default AI-agent skill paths, recursively removes each target, then copies its bundled skill files there.

Policy narrative

On installation, the package automatically invokes install.mjs. Unless an environment variable changes the destination, it selects several AI-agent skill directories, including Codex and Claude locations. For each target it recursively deletes the existing directory and copies its own skill bundle. This is unconsented postinstall mutation of a broad, foreign AI-agent control surface.

AI rationale

The automatic lifecycle hook overwrites multiple AI-agent skill locations, including foreign product directories. This meets the install-control-surface block condition.

Evidence

package.jsoninstall.mjsskills/lj-awb.cc-switch/skills/lj-awb.claude/skills/lj-awb$CODEX_HOME/skills/lj-awb

Decision evidence

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/awb-core/src/common.jsView file

6Trigger-reachable persistence chain: manifest.bin -> packages/awb-cli/bin/lj-awb.js -> packages/awb-core/src/standalone.js -> packages/awb-core/src/common.js L6: L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L136: path.join(os.homedir(), '.zprofile'), L137: path.join(os.homedir(), '.zshrc'), L138: path.join(os.homedir(), '.profile'), ... L154: try {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

packages/awb-core/src/common.jsView on unpkg · L6

6L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L136: path.join(os.homedir(), '.zprofile'), L137: path.join(os.homedir(), '.zshrc'), L138: path.join(os.homedir(), '.profile'), ... L154: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/awb-core/src/common.jsView on unpkg · L6

6L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L136: path.join(os.homedir(), '.zprofile'), L137: path.join(os.homedir(), '.zshrc'), L138: path.join(os.homedir(), '.profile'), ... L154: try {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/awb-core/src/common.jsView on unpkg · L6

install.mjsView file

1#!/usr/bin/env node L2: import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs'; L3: import { homedir } from 'node:os'; ... L9: function copyDirectory(sourceDir, targetDir) { L10: mkdirSync(targetDir, { recursive: true }); L11: for (const entry of readdirSync(sourceDir, { withFileTypes: true })) { ... L17: } else { L18: cpSync(sourcePath, targetPath); L19: } ... L25: const explicitSkillTargetDir = process.env.LINGJING_AWB_SKILL_INSTALL_DIR || process.env.ANIME_SKILL_INSTALL_DIR; L26: const codexHomeDir = process.env.CODEX_HOME || join(homedir(), '.codex'); L27:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L1

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg

build/_shared.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/_shared.mjs#virtual:normalized:round1View on unpkg

packages/awb-core/src/update.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/lj-awb-cli-pre@0.5.17 matchedPath = packages/awb-core/src/update.js matchedIdentity = npm:[redacted]:0.5.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/update.jsView on unpkg

packages/awb-core/src/services.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lingjingai/lj-awb-cli@0.5.6 matchedIdentity = npm:QGxpbmdqaW5nYWkvbGotYXdiLWNsaQ:0.5.6 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/awb-core/src/services.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 12-51json

12 "cli-table3": "^0.6.5",

13 "undici": "^6.28.1"

14 },

15 "engines": {

16 "node": ">=20"

17 },

18 "workspaces": [

19 "packages/*"

20 ],

21 "scripts": {

22 "build": "node build/build.mjs",

23 "build:pre": "node build/pre.mjs",

24 "build:volta-pre": "node build/volta-pre.mjs",

25 "build:pre-publish": "node build/pre-publish.mjs",

26 "build:prod": "node build/prod.mjs",

27 "check": "npm run check:local && npm run check:real",

28 "check:local": "node --check install.mjs && node --check packages/awb-core/src/common.js && node --check packages/awb-core/src/api.js && node --check packages/awb-core/src/auth.js && node --check packages/awb-core/src/output.js && node --check packages/awb-core/src/update.js && node --check packages/awb-core/src/services.js && node --check packages/awb-core/src/commands.js && node --check packages/awb-core/src/standalone.js && sh -n packages/awb-cli/bin/lj-awb && bash -n skills/lj-awb/scripts/resolve-lj-awb-cmd.sh && node --check packages/awb-cli/bin/lj-awb.js && node --check build/build.m ...

29 "check:real": "node scripts/validate-cli-output-contract.mjs && node scripts/validate-openapi-cli-examples.mjs",

30 "test:openapi-real": "node scripts/run-openapi-cli-examples-real.mjs",

31 "smoke": "packages/awb-cli/bin/lj-awb --help && packages/awb-cli/bin/lj-awb auth status -f json && packages/awb-cli/bin/lj-awb system && packages/awb-cli/bin/lj-awb auth &&

32 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "version:sync": "node scripts/sync-versions.mjs"

34 },

35 "files": [

36 "build",

37 "install.mjs",

38 "packages/awb-core",

39 "packages/awb-cli",

40 "skills/lj-awb",

41 "README.md"

42 ],

43 "keywords": [

44 "awb",

45 "agent",

46 "cli",

47 "skill",

48 "lingjing"

49 ]

50}

51

Long lines were clipped for display.

packages/awb-core/src/common.jsView file

Lines 1-26javascript

1import fsSync from 'node:fs';

2import fs from 'node:fs/promises';

3import crypto from 'node:crypto';

4import os from 'node:os';

install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs';

3import { homedir } from 'node:os';

4import { basename, dirname, join } from 'node:path';

5import { fileURLToPath } from

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg

build/_shared.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/_shared.mjs#virtual:normalized:round1View on unpkg

packages/awb-core/src/update.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/lj-awb-cli-pre@0.5.17 matchedPath = packages/awb-core/src/update.js matchedIdentity = npm:[redacted]:0.5.17 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/update.jsView on unpkg

packages/awb-core/src/services.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lingjingai/lj-awb-cli@0.5.6 matchedIdentity = npm:QGxpbmdqaW5nYWkvbGotYXdiLWNsaQ:0.5.6 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/awb-core/src/services.jsView on unpkg