registry / @lingjingai/lj-awb-cli-pre / 0.5.20

@lingjingai/lj-awb-cli-pre@0.5.20

Lingjing AWB CLI monorepo with shared core, standalone CLI, and agent skills (pre-release build pointing to https://animeworkbench-pre.lingjingai.cn)

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Source confirms automatic postinstall setup of the package's own skill in user-level agent directories, including recursive deletion and replacement. This is a guarded-category warning under the policy, with no verified broader control-surface hijack or separate malicious chain in the inspected evidence.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install invokes the package's postinstall script.

Impact

Existing contents at those selected skill paths can be deleted or replaced, and agent behavior may be affected by the installed skill.

Mechanism

The installer selects default Codex, Claude, and cc-switch skill locations, recursively removes each target, then copies its bundled skill directory into place.

AI rationale

Evidence

package.jsoninstall.mjs~/.cc-switch/skills/lj-awb~/.codex/skills/lj-awb~/.claude/skills/lj-awb

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs install.mjs during postinstall.
install.mjs defaults to skill directories for Codex, Claude, and cc-switch under the user's home directory.
The installer recursively removes each target directory and copies the package's skill bundle there.

Evidence against

The installer supports an explicit skip flag and an explicit target directory.
The inspected runtime code uses the package's configured API origin and the update check caches version information.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 589 KB of source, external domains: animeworkbench-pre.lingjingai.cn, animeworkbench.lingjingai.cn, docs.volcengine.com, registry.npmjs.org, volta.sh

Source & flagged code

9 flagged

package.jsonView file

Lines 12-51json

12 "cli-table3": "^0.6.5",

13 "undici": "^6.28.1"

14 },

15 "engines": {

16 "node": ">=20"

17 },

18 "workspaces": [

19 "packages/*"

20 ],

21 "scripts": {

22 "build": "node build/build.mjs",

23 "build:pre": "node build/pre.mjs",

24 "build:volta-pre": "node build/volta-pre.mjs",

25 "build:pre-publish": "node build/pre-publish.mjs",

26 "build:prod": "node build/prod.mjs",

27 "check": "npm run check:local && npm run check:real",

28 "check:local": "node --check install.mjs && node --check packages/awb-core/src/common.js && node --check packages/awb-core/src/api.js && node --check packages/awb-core/src/auth.js && node --check packages/awb-core/src/output.js && node --check packages/awb-core/src/update.js && node --check packages/awb-core/src/services.js && node --check packages/awb-core/src/commands.js && node --check packages/awb-core/src/standalone.js && sh -n packages/awb-cli/bin/lj-awb && bash -n skills/lj-awb/scripts/resolve-lj-awb-cmd.sh && node --check packages/awb-cli/bin/lj-awb.js && node --check build/build.m ...

29 "check:real": "node scripts/validate-cli-output-contract.mjs && node scripts/validate-openapi-cli-examples.mjs",

30 "test:openapi-real": "node scripts/run-openapi-cli-examples-real.mjs",

31 "smoke": "packages/awb-cli/bin/lj-awb --help && packages/awb-cli/bin/lj-awb auth status -f json && packages/awb-cli/bin/lj-awb system && packages/awb-cli/bin/lj-awb auth &&

32 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "version:sync": "node scripts/sync-versions.mjs"

34 },

35 "files": [

36 "build",

37 "install.mjs",

38 "packages/awb-core",

39 "packages/awb-cli",

40 "skills/lj-awb",

41 "README.md"

42 ],

43 "keywords": [

44 "awb",

45 "agent",

46 "cli",

47 "skill",

48 "lingjing"

49 ]

50}

Long lines were clipped for display.

packages/awb-core/src/common.jsView file

Lines 1-26javascript

1import fsSync from 'node:fs';

2import fs from 'node:fs/promises';

3import crypto from 'node:crypto';

4import os from 'node:os';

install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs';

3import { homedir } from 'node:os';

4import { basename, dirname, join } from 'node:path';

5import { fileURLToPath } from

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg

build/_shared.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/_shared.mjs#virtual:normalized:round1View on unpkg

packages/awb-core/src/update.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/lj-awb-cli@0.5.18 matchedPath = packages/awb-core/src/update.js matchedIdentity = npm:QGxpbmdqaW5nYWkvbGotYXdiLWNsaQ:0.5.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/update.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/awb-core/src/common.jsView file

6Trigger-reachable persistence chain: manifest.bin -> packages/awb-cli/bin/lj-awb.js -> packages/awb-core/src/standalone.js -> packages/awb-core/src/common.js L6: L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench-pre.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L136: path.join(os.homedir(), '.zprofile'), L137: path.join(os.homedir(), '.zshrc'), L138: path.join(os.homedir(), '.profile'), ... L154: try {

Findings

1 Critical4 High6 Medium5 Low

CriticalAi Agent Control Hijackinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Persistencepackages/awb-core/src/common.js

HighSemantic Analysis Limitedbuild/_shared.mjs#virtual:normalized:round1

HighKnown Malware Source Similaritypackages/awb-core/src/update.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencepackages/awb-core/src/common.js

MediumShips Build Helperskills/lj-awb/scripts/resolve-lj-awb-cmd.sh

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to @lingjingai/lj-awb-cli-pre@0.5.20.

See all versions of @lingjingai/lj-awb-cli-pre for other recorded verdicts.

Review the evidence and your use of @lingjingai/lj-awb-cli-pre@0.5.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 11:15:29.977Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @lingjingai

Behavioral surface

Related packages

More from @lingjingai

Source & flagged code