registry / @shendu-sdt/sd-zentao-cli / 0.1.14

@shendu-sdt/sd-zentao-cli@0.1.14

SD internal ZenTao CLI for bug, task, and workhour workflows.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The package performs unconsented postinstall mutation of broad AI-agent control surfaces by installing package-supplied skill instructions into multiple agent home directories. The installed instructions steer AI assistants toward the package CLI for internal ZenTao workflows, including write operations.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install runs package.json postinstall

Impact

Can alter AI assistant behavior on the host without an explicit user setup command; no separate exfiltration or destructive payload was found.

Mechanism

postinstall AI skill/rule installation across agent config directories

Policy narrative

On installation, npm runs scripts/install-ai-skill.mjs automatically. That script creates multiple AI assistant skill directories in the user's home and copies package-controlled SKILL.md into them, plus removes prior zentao-cli skill directories. The skill changes future agent behavior by instructing assistants to use this package's szt command for ZenTao workflows, including bug and workhour actions.

Rationale

Static inspection confirms a postinstall hook mutates broad/foreign AI-agent control surfaces without requiring an explicit setup command, which matches the firewall block policy. The rest of the CLI appears package-aligned and does not show credential exfiltration or remote payload execution, but the install-time AI control-surface write is sufficient to block.

Evidence

package.jsonscripts/install-ai-skill.mjsskills/sd-zentao-cli/SKILL.mddist/index.jsdist/config.jsdist/api.js~/.codex/skills/sd-zentao-cli/SKILL.md~/.agents/skills/sd-zentao-cli/SKILL.md~/.claude/skills/sd-zentao-cli/SKILL.md~/.cursor/skills/sd-zentao-cli/SKILL.md~/.qoder/skills/sd-zentao-cli/SKILL.md~/.gemini/config/skills/sd-zentao-cli/SKILL.md~/.antigravity/skills/sd-zentao-cli/SKILL.md~/.windsurf/skills/sd-zentao-cli/SKILL.md~/.aider/skills/sd-zentao-cli/SKILL.md~/.trae/skills/sd-zentao-cli/SKILL.md~/.hermes/skills/sd-zentao-cli/SKILL.md

Network endpoints2

pm.sdpjw.com/index.phpregistry.npmjs.org/

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for policy block

package.json defines postinstall: node scripts/install-ai-skill.mjs
scripts/install-ai-skill.mjs copies SKILL.md into broad AI-agent directories under ~/.codex, ~/.agents, ~/.claude, ~/.cursor, ~/.gemini, etc.
postinstall also removes old zentao-cli skill directories across the same agent surfaces
SKILL.md instructs agents to prefer szt and guides bug/workhour write workflows

Evidence against

No credential exfiltration found; saved ZenTao credentials stay in ~/.szt-cli/config.json with 0600 permissions
Network use is ZenTao-aligned via configured URL/default https://pm.sdpjw.com/index.php and REST/legacy API calls
child_process use is limited to invoking install-ai-skill.mjs and retrying the same CLI after relogin; git execFile supports user-invoked work scan
No eval/vm/dynamic remote payload loading found

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 16 file(s), 170 KB of source, external domains: pm.sdpjw.com, registry.npmjs.org

Source & flagged code

3 flagged

package.jsonView file

Lines 12-52json

12 "publishConfig": {

13 "registry": "https://registry.npmjs.org/"

14 },

15 "keywords": [

16 "zentao",

17 "cli",

18 "szt",

19 "workhour",

20 "bug"

21 ],

22 "bin": {

23 "szt": "dist/index.js"

24 },

25 "files": [

26 "dist",

27 "skills",

28 "scripts/install-ai-skill.mjs"

29 ],

30 "scripts": {

31 "build": "tsc -p tsconfig.json",

32 "postinstall": "node scripts/install-ai-skill.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 "sync-skill": "node scripts/install-ai-skill.mjs",

34 "prepublishOnly": "npm test && npm run build && npm pack --dry-run",

35 "test": "vitest run",

36 "typecheck": "tsc -p tsconfig.json --noEmit",

37 "check": "npm run typecheck && npm test && npm run build",

38 "release:patch": "node scripts/release.mjs patch",

39 "release:minor": "node scripts/release.mjs minor",

40 "release:major": "node scripts/release.mjs major",

41 "release:current": "node scripts/release.mjs current --no-version",

42 "dev": "tsx src/index.ts"

43 },

44 "dependencies": {

45 "commander": "^12.1.0"

46 },

47 "devDependencies": {

48 "@types/node": "^22.10.2",

49 "tsx": "^4.19.2",

50 "typescript": "^5.7.2",

51 "vitest": "^2.1.8"

52 },

dist/index.jsView file

Lines 146-186javascript

146 const { client, auth, account } = await authenticatedClient();

147 const data = auth.type === 'rest'

148 ? await client.request('/users/me', { token: auth.token })

149 : {

150 account,

151 authType: 'legacy',

152 sessionName: auth.sessionName

153 };

154 outputResult(data);

155});

156program

157 .command('doctor')

158 .description('检查 URL、REST API 和登录态')

159 .action(async () => {

160 const config = await loadConfig();

161 const baseUrl = requireBaseUrl(config);

162 const client = new ZenTaoClient({ baseUrl });

163 const checks = [];

164 checks.push({ item: 'config.url', status: 'ok', detail: baseUrl });

165 try {

166 await client.request('/tokens', { method: 'POST', body: { account: '__zt_doctor__', password: '__zt_doctor__' } });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L166

167 checks.push({ item: 'api.php/v1/tokens', status: 'reachable', detail: '接口可访问；请使用真实账号登录。' });

168 }

169 catch (error) {

170 const message = error.message;

171 const reachable = !message.includes('接口不存在') && !message.includes('非 JSON');

172 checks.push({

173 item: 'api.php/v1/tokens',

174 status: reachable ? 'reachable' : 'failed',

175 detail: message

176 });

177 }

178 if (config.token || (config.sessionName && config.sessionID)) {

179 try {

180 const auth = requireAuth(config);

181 if (auth.type === 'rest') {

182 await client.request('/users/me', { token: auth.token });

183 checks.push({ item: 'auth', status: 'ok', detail: `${config.account || '<unknown account>'} / REST` });

184 }

185 else {

186 await client.legacyRequest('my', 'index', {

scripts/install-ai-skill.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { copyFileSync, existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';

3import { dirname, join, resolve } from 'node:path';

4import { fileURLToPath } from 'node:url';

5import { homedir } from 'node:os';

7const rootDir = dirname(dirname(fileURLToPath(import.meta.url)));

8const skillName = 'sd-zentao-cli';

9const oldSkillName = 'zentao-cli';

10const source = join(rootDir, 'skills', skillName, 'SKILL.md');

11const options = parseArgs(process.argv.slice(2));

12const targets = [

13 join(homedir(), '.codex', 'skills', skillName, 'SKILL.md'),

14 join(homedir(), '.agents', 'skills', skillName, 'SKILL.md'),

15 join(homedir(), '.claude', 'skills', skillName, 'SKILL.md'),

16 join(homedir(), '.cursor', 'skills', skillName, 'SKILL.md'),

17 join(homedir(), '.qoder', 'skills', skillName, 'SKILL.md'),

18 join(homedir(), '.gemini', 'config', 'skills', skillName, 'SKILL.md'),

19 join(homedir(), '.antigravity', 'skills', skillName, 'SKILL.md'),

20 join(homedir(), '.windsurf', 'skills', skillName, 'SKILL.md'),

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-ai-skill.mjsView on unpkg · L1

21 join(homedir(), '.aider', 'skills', skillName, 'SKILL.md'),

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-ai-skill.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.jsView file

166patternName = generic_password severity = medium line = 166 matchedText = await cl... });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L166

scripts/install-ai-skill.mjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: import { copyFileSync, existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'; L3: import { dirname, join, resolve } from 'node:path'; ... L12: const targets = [ L13: join(homedir(), '.codex', 'skills', skillName, 'SKILL.md'), L14: join(homedir(), '.agents', 'skills', skillName, 'SKILL.md'), L15: join(homedir(), '.claude', 'skills', skillName, 'SKILL.md'), L16: join(homedir(), '.cursor', 'skills', skillName, 'SKILL.md'), ... L25: const oldTargets = [ L26: join(homedir(), '.codex', 'skills', oldSkillName), L27: join(homedir(), '.agents', 'skills', oldSkillName), L28: join(homedir(), '.claude', 'skills', oldSkillName), Payload evidence from skills/sd-zentao-cli/SKILL.md: L18: ```bash L19: npm install -g --registry=https://registry.npmjs.org/ @shendu-sdt/sd-zentao-cli L20: szt setup

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-ai-skill.mjsView on unpkg · L1

Findings

1 Critical1 High3 Medium6 Low

CriticalAi Agent Control Hijackscripts/install-ai-skill.mjs

HighInstall Time Lifecycle Scriptspackage.json

MediumSecret Patterndist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License