@lyra_wang/chrome-frequent-pages@0.5.2
Chrome 高频网页 → 飞书「常用网页」表 + 按分类导出 Chrome 书签（根域名 / 10 天 / >5 次）
AI Security Review
scanned 12d ago · by lpm-firewall-aiThere is no npm lifecycle hook, and the scheduled flow requires running the optional installer. Once installed, it automatically writes new-page summaries through the user's Feishu CLI to a fixed table, so the separate destination remains an unresolved disclosure risk.
Static reason
No blocking static signals were detected.
Trigger
A user runs install.sh; the registered task then runs at startup when that week has not yet been processed.
Impact
Browsing activity may be disclosed to a Feishu table separate from the user's configured collection table.
Mechanism
The task compares Feishu table snapshots, places new page titles and domains in a summary, and submits it through the local user-authenticated CLI to the fixed inbox table.
AI rationale
There is no npm lifecycle hook, and the scheduled flow requires running the optional installer. Once installed, it automatically writes new-page summaries through the user's Feishu CLI to a fixed table, so the separate destination remains an unresolved disclosure risk.
Evidence
install.shrun-if-due.shtable_snapshot.pyinbox-deliver-mac.py
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a command-line entrypoint and lists the installer and helper files.
- The collector reads a local Chrome history copy and sends page records to the configured Feishu table.
- The scheduled task builds a summary containing new page titles and domains, then calls the inbox helper.
- The inbox helper uses fixed Feishu table identifiers with the local user-authenticated CLI and creates a record containing that summary.
- The README describes the optional weekly inbox workflow; the installer must be run to register it.
Evidence against
- The manifest has no npm lifecycle scripts, so package installation alone does not activate the scheduled task.
- The primary collection table is selected through user configuration.
- The scheduled inbox behavior is documented, and the summary is limited to new-page details.
Behavioral surface
ChildProcess
Source & flagged code
9 flaggedinbox-deliver-mac.pyView file
•path = inbox-deliver-mac.py
kind = build_helper
sizeBytes = 2419
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
inbox-deliver-mac.pyView on unpkg11BASE = "NeujbbOfcaPEvMsPIxscaJImn9d"
INBOX = "tbl9LghPBTjFLH4N"
TASKS = "tbl4k7ggY1paqoUn"
LARK = "lark-cli"
def lark(args):
cmd = [LARK] + args + ["--as", "user", "--format", "json"]
res = subprocess.run(cmd, capture_output=True, text=True, timeout=90)
try:
payload = json.loads(res.stdout or "{}")
except Exception:
payload = {}
if payload.get("ok") is False:
raise SystemExit("lark-cli failed: " + json.dumps(payload.get("error", payload), ensure_ascii
Medium
Ai Review Evidence
The inbox helper uses fixed Feishu table identifiers with the local user-authenticated CLI and creates a record containing that summary.
inbox-deliver-mac.pyView on unpkg · L1149summary = args.summary.strip()
if len(summary) > 300:
summary = summary[:299] + "…"
record = {
"结果摘要": summary,
"结果": [args.result],
"状态": ["未读"],
"执行任务": int(datetime.now().timestamp() * 1000),
}
rid = task_record_id(args.task)
if rid:
record["关
Findings
9 Medium
MediumShips Build Helperinbox-deliver-mac.py
MediumAi Review Evidencepackage.json
MediumAi Review Evidencemain.py
MediumAi Review Evidencemain.py
MediumAi Review Evidencerun-if-due.sh
MediumAi Review Evidenceinbox-deliver-mac.py
MediumAi Review Evidenceinbox-deliver-mac.py
MediumAi Review Evidenceinbox-deliver-mac.py
MediumAi Review Evidenceinstall.sh
Affected versions and remediation
This report applies to @lyra_wang/chrome-frequent-pages@0.5.2.
See all versions of @lyra_wang/chrome-frequent-pages for other recorded verdicts.
- Review the evidence and your use of @lyra_wang/chrome-frequent-pages@0.5.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.