registry / @lingjingai/lj-awb-cli-pre / 0.5.5

@lingjingai/lj-awb-cli-pre@0.5.5

⚠ Under review

Lingjing AWB CLI monorepo with shared core, standalone CLI, and agent skills (pre-release build pointing to https://animeworkbench-pre.lingjingai.cn)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 555 KB of source, external domains: animeworkbench-pre.lingjingai.cn, animeworkbench.lingjingai.cn, registry.npmjs.org, volta.sh

Source & flagged code

6 flagged

package.jsonView file

Lines 11-50json

11 "chalk": "^5.6.2",

12 "cli-table3": "^0.6.5"

13 },

14 "engines": {

15 "node": ">=20"

16 },

17 "workspaces": [

18 "packages/*"

19 ],

20 "scripts": {

21 "build": "node build/build.mjs",

22 "build:pre": "node build/pre.mjs",

23 "build:volta-pre": "node build/volta-pre.mjs",

24 "build:pre-publish": "node build/pre-publish.mjs",

25 "build:prod": "node build/prod.mjs",

26 "check": "npm run check:local && npm run check:real",

27 "check:local": "node --check install.mjs && node --check packages/awb-core/src/common.js && node --check packages/awb-core/src/api.js && node --check packages/awb-core/src/auth.js && node --check packages/awb-core/src/output.js && node --check packages/awb-core/src/update.js && node --check packages/awb-core/src/services.js && node --check packages/awb-core/src/commands.js && node --check packages/awb-core/src/standalone.js && sh -n packages/awb-cli/bin/lj-awb && bash -n skills/lj-awb/scripts/resolve-lj-awb-cmd.sh && node --check packages/awb-cli/bin/lj-awb.js && node --check build/build.m ...

28 "check:real": "node scripts/validate-cli-output-contract.mjs && node scripts/validate-openapi-cli-examples.mjs",

29 "test:openapi-real": "node scripts/run-openapi-cli-examples-real.mjs",

30 "smoke": "packages/awb-cli/bin/lj-awb --help && packages/awb-cli/bin/lj-awb auth status -f json && packages/awb-cli/bin/lj-awb system && packages/awb-cli/bin/lj-awb auth && packages/awb-cli/bin/lj-awb account && packages/awb-cli/bin/lj-awb project &&

31 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "version:sync": "node scripts/sync-versions.mjs"

33 },

34 "files": [

35 "build",

36 "install.mjs",

37 "packages/awb-core",

38 "packages/awb-cli",

39 "skills/lj-awb",

40 "README.md"

41 ],

42 "keywords": [

43 "awb",

44 "agent",

45 "cli",

46 "skill",

47 "lingjing"

48 ]

49}

Long lines were clipped for display.

packages/awb-core/src/common.jsView file

Lines 1-26javascript

1import fsSync from 'node:fs';

2import fs from 'node:fs/promises';

3import crypto from 'node:crypto';

4import os from 'node:os';

5import path from 'node:path';

install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs';

3import { homedir } from 'node:os';

4import { basename, dirname, join } from 'node:path';

5import { fileURLToPath } from 'node:url';

7const

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/awb-core/src/common.jsView file

6L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench-pre.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L135: path.join(os.homedir(), '.zprofile'), L136: path.join(os.homedir(), '.zshrc'), L137: path.join(os.homedir(), '.profile'), ... L153: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/awb-core/src/common.jsView on unpkg · L6

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/awb-core/src/common.jsView on unpkg · L6

install.mjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs'; L3: import { homedir } from 'node:os'; ... L9: function copyDirectory(sourceDir, targetDir) { L10: mkdirSync(targetDir, { recursive: true }); L11: for (const entry of readdirSync(sourceDir, { withFileTypes: true })) { ... L17: } else { L18: cpSync(sourcePath, targetPath); L19: } ... L25: const explicitSkillTargetDir = process.env.LINGJING_AWB_SKILL_INSTALL_DIR || process.env.ANIME_SKILL_INSTALL_DIR; L26: const codexHomeDir = process.env.CODEX_HOME || join(homedir(), '.codex'); L27: Payload evidence from skills/lj-awb/SKILL.md: L4: description: "灵境 AWB CLI skill。使用 `lj-awb` 命令调用动漫平台 / AWB 云端能力，覆盖认证、项目组、积分余额/明细/用量（含充值购买与兑换码兑换）、模型发现、上传、统一 create 创建域、任务查询、视频超分。用户说生图、生视频、积分明细、积分流水、充值记录、消耗记录、主体、音色、素材加白、去字幕时使用。正式生成... L5: metadata: L6: bootstrap: ... L56: L57: 脚本 stdout 只输出可执行命令；安装日志和错误走 stderr。后续命令优先使用解析结果： L58:

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

install.mjsView on unpkg · L1

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg

Findings

1 Critical1 High6 Medium5 Low

CriticalAi Agent Control Hijackinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencepackages/awb-core/src/common.js

MediumShips Build Helperskills/lj-awb/scripts/resolve-lj-awb-cmd.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptopackages/awb-core/src/common.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 11-50json

11 "chalk": "^5.6.2",

12 "cli-table3": "^0.6.5"

13 },

14 "engines": {

15 "node": ">=20"

16 },

17 "workspaces": [

18 "packages/*"

19 ],

20 "scripts": {

21 "build": "node build/build.mjs",

22 "build:pre": "node build/pre.mjs",

23 "build:volta-pre": "node build/volta-pre.mjs",

24 "build:pre-publish": "node build/pre-publish.mjs",

25 "build:prod": "node build/prod.mjs",

26 "check": "npm run check:local && npm run check:real",

28 "check:real": "node scripts/validate-cli-output-contract.mjs && node scripts/validate-openapi-cli-examples.mjs",

29 "test:openapi-real": "node scripts/run-openapi-cli-examples-real.mjs",

31 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "version:sync": "node scripts/sync-versions.mjs"

33 },

34 "files": [

35 "build",

36 "install.mjs",

37 "packages/awb-core",

38 "packages/awb-cli",

39 "skills/lj-awb",

40 "README.md"

41 ],

42 "keywords": [

43 "awb",

44 "agent",

45 "cli",

46 "skill",

47 "lingjing"

48 ]

49}

Long lines were clipped for display.

packages/awb-core/src/common.jsView file

Lines 1-26javascript

1import fsSync from 'node:fs';

2import fs from 'node:fs/promises';

3import crypto from 'node:crypto';

4import os from 'node:os';

5import path from 'node:path';

install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs';

3import { homedir } from 'node:os';

4import { basename, dirname, join } from 'node:path';

5import { fileURLToPath } from 'node:url';

7const

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg