registry / AI-agent control-surface risk / @qzhuli/qzhuli-cli
@qzhuli/qzhuli-cli
CLI tool for Q助理 (QZhuli)
This report shows the evidence for @qzhuli/qzhuli-cli@0.5.12. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic postinstall hook mutates a broad set of foreign AI-agent control surfaces, meeting the install-control-surface block policy. No runtime self-dependency or install-time network exfiltration was found, but neither is required for this concrete lifecycle abuse.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm installation, through the postinstall lifecycle hook.
Impact
A dependency install changes foreign agent control surfaces in the user home directory or consumer project without an explicit setup command.
Mechanism
Automatic broad AI-agent skill installation and replacement.
Policy narrative
The package registers postinstall, which detects many AI-agent installations and copies its bundled skill into their global or project skill locations. If no agent is detected it selects Claude Code, and it always adds a generic agents target. The installation is automatic rather than an explicit user setup action; updates can delete files within the package-owned destination skill directory before copying replacement content.
AI rationale
The automatic postinstall hook mutates a broad set of foreign AI-agent control surfaces, meeting the install-control-surface block policy. No runtime self-dependency or install-time network exfiltration was found, but neither is required for this concrete lifecycle abuse.
Evidence
package.jsonscripts/postinstall.mjsscripts/skill-agent.mjsskills/qzhuli-cli~/.claude/skills/qzhuli-cli~/.codex/skills/qzhuli-cli~/.agents/skills/qzhuli-cli.claude/skills/qzhuli-cli.codex/skills/qzhuli-cli.agents/skills/qzhuli-cli
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest automatically runs a postinstall script.
- Postinstall detects installed AI agents, defaults to Claude Code when none are found, and always adds a generic agents target.
- The lifecycle script copies the bundled skill into global or consumer-project agent skill directories without a user command.
- The target map covers numerous unrelated agent control surfaces, including Codex, Cursor, Copilot, Claude Code, and a generic agents directory.
- The copy helper deletes destination files absent from the new skill before copying the replacement.
Evidence against
- The lifecycle scripts contain no network request, shell execution, or credential harvesting.
- Runtime network endpoints are QZhuli product services used by the CLI after user invocation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/skill-agent.mjsView file
9readFileSync,
L10: writeFileSync,
L11: copyFileSync,
L12: mkdirSync,
L13: rmSync,
...
L19: // ── Agent path mapping ─────────────────────────────────────────────
L20: // Source: https://www.agentskills.in/docs/getting-started
L21: export const AGENT_PATHS = [
L22: { name: 'claude-code', global: '~/.claude/skills', project: '.claude/skills' },
L23: { name: 'cursor', global: '~/.cursor/skills', project: '.cursor/skills' },
L24: { name: 'codex', global: '~/.codex/skills', project: '.codex/skills' },
L25: { name: 'copilot', global: '~/.copilot/skills', project: '.github/skills' },
Findings
1 Critical2 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/skill-agent.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturedist/cmd.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @qzhuli/qzhuli-cli@0.5.12.
The versions list below shows the verdict for each recorded version.
- Avoid installing @qzhuli/qzhuli-cli@0.5.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.