registry / @lingjingai/lj-awb-cli-pre / 0.5.19

@lingjingai/lj-awb-cli-pre@0.5.19

Lingjing AWB CLI monorepo with shared core, standalone CLI, and agent skills (pre-release build pointing to https://animeworkbench-pre.lingjingai.cn)

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Source confirms automatic postinstall replacement of AI-agent skill directories with the package's own CLI skill. This matches first-party agent extension setup, which warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package with lifecycle scripts enabled.

Impact

Existing files in those target skill directories can be replaced; the bundled skill becomes available to the selected agents.

Mechanism

The installer recursively deletes each configured or default skill target, then copies the bundled skill into it.

AI rationale

Evidence

package.jsoninstall.mjsskills/lj-awb/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs install.mjs automatically through its postinstall hook.
The installer targets lj-awb skill directories under cc-switch, Codex, and Claude homes by default, or a user-configured directory.
For each target, the installer recursively removes the existing directory and copies in the package's skill files.
The installed skill identifies itself as the package's lj-awb skill and invokes its CLI.

Evidence against

The installer copies this package's own skill bundle; inspected source showed no remote payload fetch or credential forwarding in this install path.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 589 KB of source, external domains: animeworkbench-pre.lingjingai.cn, animeworkbench.lingjingai.cn, docs.volcengine.com, registry.npmjs.org, volta.sh

Source & flagged code

10 flagged

package.jsonView file

Lines 12-51json

12 "cli-table3": "^0.6.5",

13 "undici": "^6.28.1"

14 },

15 "engines": {

16 "node": ">=20"

17 },

18 "workspaces": [

19 "packages/*"

20 ],

21 "scripts": {

22 "build": "node build/build.mjs",

23 "build:pre": "node build/pre.mjs",

24 "build:volta-pre": "node build/volta-pre.mjs",

25 "build:pre-publish": "node build/pre-publish.mjs",

26 "build:prod": "node build/prod.mjs",

27 "check": "npm run check:local && npm run check:real",

28 "check:local": "node --check install.mjs && node --check packages/awb-core/src/common.js && node --check packages/awb-core/src/api.js && node --check packages/awb-core/src/auth.js && node --check packages/awb-core/src/output.js && node --check packages/awb-core/src/update.js && node --check packages/awb-core/src/services.js && node --check packages/awb-core/src/commands.js && node --check packages/awb-core/src/standalone.js && sh -n packages/awb-cli/bin/lj-awb && bash -n skills/lj-awb/scripts/resolve-lj-awb-cmd.sh && node --check packages/awb-cli/bin/lj-awb.js && node --check build/build.m ...

29 "check:real": "node scripts/validate-cli-output-contract.mjs && node scripts/validate-openapi-cli-examples.mjs",

30 "test:openapi-real": "node scripts/run-openapi-cli-examples-real.mjs",

31 "smoke": "packages/awb-cli/bin/lj-awb --help && packages/awb-cli/bin/lj-awb auth status -f json && packages/awb-cli/bin/lj-awb system && packages/awb-cli/bin/lj-awb auth &&

32 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "version:sync": "node scripts/sync-versions.mjs"

34 },

35 "files": [

36 "build",

37 "install.mjs",

38 "packages/awb-core",

39 "packages/awb-cli",

40 "skills/lj-awb",

41 "README.md"

42 ],

43 "keywords": [

44 "awb",

45 "agent",

46 "cli",

47 "skill",

48 "lingjing"

49 ]

50}

Long lines were clipped for display.

packages/awb-core/src/common.jsView file

Lines 1-26javascript

1import fsSync from 'node:fs';

2import fs from 'node:fs/promises';

3import crypto from 'node:crypto';

4import os from 'node:os';

install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs';

3import { homedir } from 'node:os';

4import { basename, dirname, join } from 'node:path';

5import { fileURLToPath } from

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg

build/_shared.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/_shared.mjs#virtual:normalized:round1View on unpkg

packages/awb-core/src/update.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/lj-awb-cli@0.5.18 matchedPath = packages/awb-core/src/update.js matchedIdentity = npm:QGxpbmdqaW5nYWkvbGotYXdiLWNsaQ:0.5.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/update.jsView on unpkg

packages/awb-core/src/services.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lingjingai/lj-awb-cli-pre@0.5.5 matchedIdentity = npm:[redacted]:0.5.5 similarity = 0.625 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/awb-core/src/services.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/awb-core/src/common.jsView file

6Trigger-reachable persistence chain: manifest.bin -> packages/awb-cli/bin/lj-awb.js -> packages/awb-core/src/standalone.js -> packages/awb-core/src/common.js L6: L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench-pre.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L136: path.join(os.homedir(), '.zprofile'), L137: path.join(os.homedir(), '.zshrc'), L138: path.join(os.homedir(), '.profile'), ... L154: try {

Findings

1 Critical5 High6 Medium5 Low

CriticalAi Agent Control Hijackinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Persistencepackages/awb-core/src/common.js

HighSemantic Analysis Limitedbuild/_shared.mjs#virtual:normalized:round1

HighKnown Malware Source Similaritypackages/awb-core/src/update.js

HighPrevious Version Dangerous Deltapackages/awb-core/src/services.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencepackages/awb-core/src/common.js

MediumShips Build Helperskills/lj-awb/scripts/resolve-lj-awb-cmd.sh

Affected versions and remediation

This report applies to @lingjingai/lj-awb-cli-pre@0.5.19.

See all versions of @lingjingai/lj-awb-cli-pre for other recorded verdicts.

Review the evidence and your use of @lingjingai/lj-awb-cli-pre@0.5.19 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 07:25:39.307Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @lingjingai

Behavioral surface

Related packages

More from @lingjingai

Source & flagged code