registry / @lingjingai/lj-awb-cli / 0.5.6

@lingjingai/lj-awb-cli@0.5.6

Lingjing AWB CLI monorepo with shared core, standalone CLI, and agent skills

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation automatically refreshes a package-named AI-agent skill in several agent homes. This is a lifecycle extension-installation risk, but the write scope is limited to lj-awb skill directories.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs postinstall.

Impact

Can replace the package's agent skill without an explicit setup command.

Mechanism

Deletes and copies a bundled skill into agent skill directories.

AI rationale

The automatic cross-agent skill installation warrants a warning. Source inspection does not establish the broader control-surface mutation or malicious execution required for a block.

Evidence

package.jsoninstall.mjspackages/awb-core/src/common.jsskills/lj-awb~/.cc-switch/skills/lj-awb$CODEX_HOME/skills/lj-awb~/.claude/skills/lj-awb

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The npm postinstall hook automatically runs the installer.
The installer replaces a lj-awb skill directory under Codex, Claude, and cc-switch locations.
CLI startup reads project and user shell environment files, increasing exposure to user configuration.

Evidence against

The installer is limited to a package-named skill subdirectory rather than whole agent configurations.
No self-dependency, install-time network request, credential exfiltration, or remote payload execution was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 555 KB of source, external domains: animeworkbench-pre.lingjingai.cn, animeworkbench.lingjingai.cn, registry.npmjs.org, volta.sh

Source & flagged code

10 flagged

package.jsonView file

Lines 11-50json

11 "chalk": "^5.6.2",

12 "cli-table3": "^0.6.5"

13 },

14 "engines": {

15 "node": ">=20"

16 },

17 "workspaces": [

18 "packages/*"

19 ],

20 "scripts": {

21 "build": "node build/build.mjs",

22 "build:pre": "node build/pre.mjs",

23 "build:volta-pre": "node build/volta-pre.mjs",

24 "build:pre-publish": "node build/pre-publish.mjs",

25 "build:prod": "node build/prod.mjs",

26 "check": "npm run check:local && npm run check:real",

27 "check:local": "node --check install.mjs && node --check packages/awb-core/src/common.js && node --check packages/awb-core/src/api.js && node --check packages/awb-core/src/auth.js && node --check packages/awb-core/src/output.js && node --check packages/awb-core/src/update.js && node --check packages/awb-core/src/services.js && node --check packages/awb-core/src/commands.js && node --check packages/awb-core/src/standalone.js && sh -n packages/awb-cli/bin/lj-awb && bash -n skills/lj-awb/scripts/resolve-lj-awb-cmd.sh && node --check packages/awb-cli/bin/lj-awb.js && node --check build/build.m ...

28 "check:real": "node scripts/validate-cli-output-contract.mjs && node scripts/validate-openapi-cli-examples.mjs",

29 "test:openapi-real": "node scripts/run-openapi-cli-examples-real.mjs",

30 "smoke": "packages/awb-cli/bin/lj-awb --help && packages/awb-cli/bin/lj-awb auth status -f json && packages/awb-cli/bin/lj-awb system && packages/awb-cli/bin/lj-awb auth &&

31 "postinstall": "node install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "version:sync": "node scripts/sync-versions.mjs"

33 },

34 "files": [

35 "build",

36 "install.mjs",

37 "packages/awb-core",

38 "packages/awb-cli",

39 "skills/lj-awb",

40 "README.md"

41 ],

42 "keywords": [

43 "awb",

44 "agent",

45 "cli",

46 "skill",

47 "lingjing"

48 ]

49}

Long lines were clipped for display.

packages/awb-core/src/common.jsView file

Lines 1-26javascript

1import fsSync from 'node:fs';

2import fs from 'node:fs/promises';

3import crypto from 'node:crypto';

4import os from 'node:os';

install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs';

3import { homedir } from 'node:os';

4import { basename, dirname, join } from 'node:path';

5import { fileURLToPath } from

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg

build/_shared.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/_shared.mjs#virtual:normalized:round1View on unpkg

packages/awb-core/src/services.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/lj-awb-cli-pre@0.5.7 matchedPath = packages/awb-core/src/services.js matchedIdentity = npm:[redacted]:0.5.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/services.jsView on unpkg

packages/awb-core/src/update.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/lj-awb-cli-pre@0.5.7 matchedPath = packages/awb-core/src/update.js matchedIdentity = npm:[redacted]:0.5.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/update.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/awb-core/src/common.jsView file

6Trigger-reachable persistence chain: manifest.bin -> packages/awb-cli/bin/lj-awb.js -> packages/awb-core/src/standalone.js -> packages/awb-core/src/common.js L6: L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L135: path.join(os.homedir(), '.zprofile'), L136: path.join(os.homedir(), '.zshrc'), L137: path.join(os.homedir(), '.profile'), ... L153: try {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

packages/awb-core/src/common.jsView on unpkg · L6

6L7: export const DEFAULT_API_ORIGIN = 'https://animeworkbench.lingjingai.cn'; L8: export const API_ORIGIN = ( L9: process.env.LINGJING_AWB_API_ORIGIN L10: || process.env.ANIME_API_ORIGIN ... L25: L26: export const APP_HOME_DIR = process.env.LINGJING_AWB_STATE_DIR || process.env.ANIME_STATE_DIR || path.join(os.homedir(), '.lingjingai', 'awb'); L27: export const AUTH_PATH = process.env.LINGJING_AWB_AUTH_PATH || process.env.ANIME_AUTH_PATH || path.join(APP_HOME_DIR, 'auth.json'); ... L135: path.join(os.homedir(), '.zprofile'), L136: path.join(os.homedir(), '.zshrc'), L137: path.join(os.homedir(), '.profile'), ... L153: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/awb-core/src/common.jsView on unpkg · L6

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/awb-core/src/common.jsView on unpkg · L6

install.mjsView file

1#!/usr/bin/env node L2: import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from 'node:fs'; L3: import { homedir } from 'node:os'; ... L9: function copyDirectory(sourceDir, targetDir) { L10: mkdirSync(targetDir, { recursive: true }); L11: for (const entry of readdirSync(sourceDir, { withFileTypes: true })) { ... L17: } else { L18: cpSync(sourcePath, targetPath); L19: } ... L25: const explicitSkillTargetDir = process.env.LINGJING_AWB_SKILL_INSTALL_DIR || process.env.ANIME_SKILL_INSTALL_DIR; L26: const codexHomeDir = process.env.CODEX_HOME || join(homedir(), '.codex'); L27:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.mjsView on unpkg · L1

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView file

•path = skills/lj-awb/scripts/resolve-lj-awb-cmd.sh kind = build_helper sizeBytes = 3529 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/lj-awb/scripts/resolve-lj-awb-cmd.shView on unpkg

build/_shared.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/_shared.mjs#virtual:normalized:round1View on unpkg

packages/awb-core/src/services.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/services.jsView on unpkg

packages/awb-core/src/update.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/awb-core/src/update.jsView on unpkg

Findings

1 Critical5 High6 Medium5 Low

CriticalAi Agent Control Hijackinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Persistencepackages/awb-core/src/common.js

HighSemantic Analysis Limitedbuild/_shared.mjs#virtual:normalized:round1

HighKnown Malware Source Similaritypackages/awb-core/src/services.js

HighKnown Malware Source Similaritypackages/awb-core/src/update.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencepackages/awb-core/src/common.js

MediumShips Build Helperskills/lj-awb/scripts/resolve-lj-awb-cmd.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptopackages/awb-core/src/common.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @lingjingai/lj-awb-cli@0.5.6.

See version security history for other recorded verdicts.

Review the evidence and your use of @lingjingai/lj-awb-cli@0.5.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 06:04:29.371Z (UTC).