registry / AI-agent control-surface risk / @lingjingai/lj-awb-cli-pre
@lingjingai/lj-awb-cli-pre
Lingjing AWB CLI monorepo with shared core, standalone CLI, and agent skills (pre-release build pointing to https://animeworkbench-pre.lingjingai.cn)
This report shows the evidence for @lingjingai/lj-awb-cli-pre@0.5.18. 12 of 16 known versions are blocked or flagged. The newest version, 0.5.21, is flagged. See all versions.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package has a concrete automatic lifecycle hook that force-replaces skill directories for several unrelated AI-agent environments. This meets the install-control-surface blocking policy even though the hook does not show network exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the npm package triggers the postinstall hook.
Impact
Installation can silently replace AI-agent skill content across multiple agent control surfaces.
Mechanism
The hook selects default cc-switch, Codex, and Claude skill paths, recursively removes each target, then copies the bundled skill directory.
Policy narrative
A registry installation automatically invokes install.mjs. Unless an environment override is supplied, it writes into cc-switch, Codex, and Claude skill directories. Before copying its own skill bundle, it recursively force-removes each existing target. This is an unconsented postinstall mutation of broad AI-agent control surfaces.
AI rationale
The package has a concrete automatic lifecycle hook that force-replaces skill directories for several unrelated AI-agent environments. This meets the install-control-surface blocking policy even though the hook does not show network exfiltration.
Evidence
package.jsoninstall.mjs~/.cc-switch/skills/lj-awb$CODEX_HOME/skills/lj-awb~/.claude/skills/lj-awb
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package automatically runs install.mjs after installation.
- The installer targets skill directories for cc-switch, Codex, and Claude when no explicit destination is set.
- The installer forcibly deletes each target directory and copies its bundled skill into it.
Evidence against
- No network transmission or credential collection was identified in the installation hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackages/awb-core/src/common.jsView file
6Trigger-reachable persistence chain: manifest.bin -> packages/awb-cli/bin/lj-awb.js -> packages/awb-core/src/standalone.js -> packages/awb-core/src/common.js
L6:
L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench-pre.lingjingai.cn';
L8: export const API_ORIGIN = (
L9: process.env.LINGJING_AWB_API_ORIGIN
L10: || process.env.ANIME_API_ORIGIN
...
L25:
L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb');
L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json');
...
L136: path.join(os.homedir(), '.zprofile'),
L137: path.join(os.homedir(), '.zshrc'),
L138: path.join(os.homedir(), '.profile'),
...
L154: try {
Findings
1 Critical5 High6 Medium5 Low
CriticalAi Agent Control Hijackinstall.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable Persistencepackages/awb-core/src/common.js
HighSemantic Analysis Limitedbuild/_shared.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritypackages/awb-core/src/update.js
HighPrevious Version Dangerous Deltapackages/awb-core/src/services.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencepackages/awb-core/src/common.js
MediumShips Build Helperskills/lj-awb/scripts/resolve-lj-awb-cmd.sh
Affected versions and remediation
This report applies to @lingjingai/lj-awb-cli-pre@0.5.18.
The versions list below shows the verdict for each recorded version.
- Avoid installing @lingjingai/lj-awb-cli-pre@0.5.18. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
16 known versions0.5.21latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 20, 2026, 9:04 AM0.5.20SuspiciousAgent extension lifecycle riskWarnPublishedOct 12, 2026, 11:12 AM0.5.19SuspiciousAgent extension lifecycle riskWarnPublishedOct 9, 2026, 7:23 AM0.5.18shownMaliciousSoft block: AI-agent control surfaceBlock