Loading npm security reports…

@lingjingai/lj-awb-cli-pre@0.5.9: AI-agent control-surface risk | LPM Firewall

registry / @lingjingai/lj-awb-cli-pre / 0.5.9

@lingjingai/lj-awb-cli-pre@0.5.9

Lingjing AWB CLI monorepo with shared core, standalone CLI, and agent skills (pre-release build pointing to https://animeworkbench-pre.lingjingai.cn)

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically replaces global AI-agent skill directories. This affects Codex, Claude, and cc-switch installations.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation

Impact

Package-controlled skills are persisted into multiple agent control surfaces without explicit user action.

Mechanism

recursive replacement of global AI-agent skill directories

Policy narrative

The npm postinstall hook invokes install.mjs automatically. Unless an opt-out variable is already set, it removes and replaces the lj-awb skill directory in cc-switch, Codex, and Claude global configuration locations. This is unconsented install-time mutation of broad AI-agent control surfaces.

AI rationale

The automatic lifecycle hook overwrites skills in several unrelated agent environments, including Codex and Claude. This is concrete install-hook abuse even though the hook does not make a network request.

Evidence

package.jsoninstall.mjsskills/lj-awb~/.cc-switch/skills/lj-awb$CODEX_HOME/skills/lj-awb~/.claude/skills/lj-awb

Decision evidence

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/awb-core/src/common.jsView file

6Trigger-reachable persistence chain: manifest.bin -> packages/awb-cli/bin/lj-awb.js -> packages/awb-core/src/standalone.js -> packages/awb-core/src/common.js L6: L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench-pre.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L136: path.join(os.homedir(), '.zprofile'), L137: path.join(os.homedir(), '.zshrc'), L138: path.join(os.homedir(), '.profile'), ... L154: try {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

packages/awb-core/src/common.jsView on unpkg · L6

6L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench-pre.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L136: path.join(os.homedir(), '.zprofile'), L137: path.join(os.homedir(), '.zshrc'), L138: path.join(os.homedir(), '.profile'), ... L154: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/awb-core/src/common.jsView on unpkg · L6

6L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench-pre.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L136: path.join(os.homedir(), '.zprofile'), L137: path.join(os.homedir(), '.zshrc'), L138: path.join(os.homedir(), '.profile'), ... L154: try {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/awb-core/src/common.jsView on unpkg · L6

install.mjsView file

1#!/usr/bin/env node L2: import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs'; L3: import { homedir } from 'node:os'; ... L9: function copyDirectory(sourceDir, targetDir) { L10: mkdirSync(targetDir, { recursive: true }); L11: for (const entry of readdirSync(sourceDir, { withFileTypes: true })) { ... L17: } else { L18: cpSync(sourcePath, targetPath); L19: } ... L25: const explicitSkillTargetDir = process.env.LINGJING_AWB_SKILL_INSTALL_DIR || process.env.ANIME_SKILL_INSTALL_DIR; L26: const codexHomeDir = process.env.CODEX_HOME || join(homedir(), '.codex'); L27:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L1

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg

build/_shared.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/_shared.mjs#virtual:normalized:round1View on unpkg

packages/awb-core/src/services.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/lj-awb-cli@0.5.9 matchedPath = packages/awb-core/src/services.js matchedIdentity = npm:QGxpbmdqaW5nYWkvbGotYXdiLWNsaQ:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/services.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5262a03a085c8416 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @lingjingai/lj-awb-cli@0.5.9 matchedPath = packages/awb-core/src/services.js matchedIdentity = npm:QGxpbmdqaW5nYWkvbGotYXdiLWNsaQ:0.5.9 similarity = 1.000 shingleOverlap = 15 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

packages/awb-core/src/services.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @lingjingai/lj-awb-cli-pre@0.5.5 matchedIdentity = npm:[redacted]:0.5.5 similarity = 0.625 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

packages/awb-core/src/update.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/lj-awb-cli@0.5.9 matchedPath = packages/awb-core/src/update.js matchedIdentity = npm:QGxpbmdqaW5nYWkvbGotYXdiLWNsaQ:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/update.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 11-50json

11 "chalk": "^5.6.2",

12 "cli-table3": "^0.6.5"

13 },

14 "engines": {

15 "node": ">=20"

16 },

17 "workspaces": [

18 "packages/*"

19 ],

20 "scripts": {

21 "build": "node build/build.mjs",

22 "build:pre": "node build/pre.mjs",

23 "build:volta-pre": "node build/volta-pre.mjs",

24 "build:pre-publish": "node build/pre-publish.mjs",

25 "build:prod": "node build/prod.mjs",

26 "check": "npm run check:local && npm run check:real",

27 "check:local": "node --check install.mjs && node --check packages/awb-core/src/common.js && node --check packages/awb-core/src/api.js && node --check packages/awb-core/src/auth.js && node --check packages/awb-core/src/output.js && node --check packages/awb-core/src/update.js && node --check packages/awb-core/src/services.js && node --check packages/awb-core/src/commands.js && node --check packages/awb-core/src/standalone.js && sh -n packages/awb-cli/bin/lj-awb && bash -n skills/lj-awb/scripts/resolve-lj-awb-cmd.sh && node --check packages/awb-cli/bin/lj-awb.js && node --check build/build.m ...

28 "check:real": "node scripts/validate-cli-output-contract.mjs && node scripts/validate-openapi-cli-examples.mjs",

29 "test:openapi-real": "node scripts/run-openapi-cli-examples-real.mjs",

30 "smoke": "packages/awb-cli/bin/lj-awb --help && packages/awb-cli/bin/lj-awb auth status -f json && packages/awb-cli/bin/lj-awb system && packages/awb-cli/bin/lj-awb auth &&

31 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "version:sync": "node scripts/sync-versions.mjs"

33 },

34 "files": [

35 "build",

36 "install.mjs",

37 "packages/awb-core",

38 "packages/awb-cli",

39 "skills/lj-awb",

40 "README.md"

41 ],

42 "keywords": [

43 "awb",

44 "agent",

45 "cli",

46 "skill",

47 "lingjing"

48 ]

49}

50

Long lines were clipped for display.

packages/awb-core/src/common.jsView file

Lines 1-26javascript

1import fsSync from 'node:fs';

2import fs from 'node:fs/promises';

3import crypto from 'node:crypto';

4import os from 'node:os';

install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs';

3import { homedir } from 'node:os';

4import { basename, dirname, join } from 'node:path';

5import { fileURLToPath } from

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg

build/_shared.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/_shared.mjs#virtual:normalized:round1View on unpkg

packages/awb-core/src/services.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/lj-awb-cli@0.5.9 matchedPath = packages/awb-core/src/services.js matchedIdentity = npm:QGxpbmdqaW5nYWkvbGotYXdiLWNsaQ:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/services.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5262a03a085c8416 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @lingjingai/lj-awb-cli@0.5.9 matchedPath = packages/awb-core/src/services.js matchedIdentity = npm:QGxpbmdqaW5nYWkvbGotYXdiLWNsaQ:0.5.9 similarity = 1.000 shingleOverlap = 15 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

packages/awb-core/src/services.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @lingjingai/lj-awb-cli-pre@0.5.5 matchedIdentity = npm:[redacted]:0.5.5 similarity = 0.625 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

packages/awb-core/src/update.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/lj-awb-cli@0.5.9 matchedPath = packages/awb-core/src/update.js matchedIdentity = npm:QGxpbmdqaW5nYWkvbGotYXdiLWNsaQ:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/update.jsView on unpkg