Loading npm security reports…

@sokeai/cli@1.0.78: Malicious npm security report (Block) | LPM Firewall

registry / @sokeai/cli / 1.0.78

@sokeai/cli@1.0.78

授客AI官方CLI工具 - 支持AI Agent Skills

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A package install automatically installs and enables bundled skills in several agent workspaces. It also downloads an unchecked executable and silently launches a detached command that can alter a global CLI symlink.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation, which invokes postinstall automatically.

Impact

An install can change multiple AI-agent control surfaces and execute downloaded code without an explicit user setup command.

Mechanism

Postinstall agent-workspace mutation and unchecked binary bootstrap.

Attack narrative

Installing the package invokes its postinstall script. That script downloads a release executable, copies all bundled skills into SokeClaw and Zev workspaces, and writes enabled entries to WorkClaw's skill registry. It then launches a detached silent GUI setup command; that command can remove and recreate a global soke-cli symlink and contains process-kill and application-launch behavior. These changes occur without an explicit user command.

Rationale

The package performs unconsented postinstall mutation of several external AI-agent control surfaces and bootstraps an unchecked executable. This is a concrete install-hook abuse chain, not merely an explicit CLI setup action.

Evidence

package.jsonscripts/install.jsscripts/run.jsbin/soke-cli~/.sokeclaw/openai-agents/workspaces/main/skills~/.zev/openai-agents/workspaces/main/skills~/.workclaw/skills~/.workclaw/skills/registry.json

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/run.jsView file

2L3: const { spawn, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

scripts/run.jsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = @sokeai/cli@1.0.63 matchedPath = scripts/run.js matchedIdentity = npm:QHNva2VhaS9jbGk:1.0.63 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/run.jsView on unpkg

scripts/install.jsView file

13if (!fs.existsSync(srcDir)) return; L14: if (!fs.existsSync(destDir)) fs.mkdirSync(destDir, { recursive: true }); L15: ... L36: L37: fs.copyFileSync(srcPath, destPath); L38: } ... L71: const config = JSON.parse(configText); L72: const workspaceDir = config?.defaults?.agents?.openaiAgents?.main?.workspace; L73: if (typeof workspaceDir === 'string' && workspaceDir.length > 0) { ... L119: try { L120: fs.mkdirSync(targetDir, { recursive: true }); L121: for (const skillName of skillNames) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L13

•matchType = previous_version_dangerous_delta matchedPackage = @sokeai/cli@1.0.74 matchedIdentity = npm:QHNva2VhaS9jbGk:1.0.74 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/install.jsView on unpkg

3const fs = require('fs'); L4: const https = require('https'); L5: const { execSync } = require('child_process'); L6: const readline = require('readline'); ... L9: const arch = os.arch(); L10: const version = require('../package.json').version; L11: ... L41: function [redacted]() { L42: const homeDir = os.homedir(); L43: const dirs = []; ... L70: const configText = fs.readFileSync(workclawConfigPath, 'utf8'); L71: const config = JSON.parse(configText);

High

scripts/local-test.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: !== after) { fs.writefilesync(target.registrypath, json.stringify(registry, null, 2)); logsuccess(` ✓ 清理 registry.json (删除 ${before - after} 个条目)`); } } } catch (err) { logerror(` ✗ 清理 registry.json 失败: ${err.message}`); } } console.log(''); } } /** * 主函数 */ function main() { const args = process.argv.slice(2); const isclean = args.includes('--clean'); const skillarg = args.find(arg => arg.startswith('--skill=')); const specificskill = skillarg ? sk[redacted]('=')[1] : null; logsection('本地 skill 测试工具'); // 检测项目目录 const packageroot = path.join(__dirname, '..'); const packagedskillsdir = path.join(packageroo

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/local-test.jsView on unpkg

scripts/push.shView file

•path = scripts/push.sh kind = build_helper sizeBytes = 6312 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/push.shView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-29json

1{

2 "name": "@sokeai/cli",

3 "version": "1.0.78",

4 "description": "授客AI官方CLI工具 - 支持AI Agent Skills",

5 "bin": {

6 "soke-cli": "scripts/run.js"

7 },

8 "scripts": {

9 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "build": "./scripts/build-binaries.sh",

11 "release": "./scripts/release.sh"

12 },

13 "files": [

14 "scripts/",

15 "skills/"

16 ],

17 "homepage": "https://github.com/sokeai/soke-cli#readme",

18 "repository": {

19 "type": "git",

20 "url": "https://github.com/sokeai/soke-cli.git"

21 },

22 "keywords": [

23 "soke",

24 "cli",

25 "授客AI",

26 "shouke",

27 "command-line",

28 "ai-agent",

29 "skills",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

scripts/run.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3const { spawn, execSync } = require('child_process');

4const path = require('path');

High

scripts/install.jsView file

Lines 1-33javascript

1const os = require('os');

2const path = require('path');

3const fs = require

scripts/local-test.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: !== after) { fs.writefilesync(target.registrypath, json.stringify(registry, null, 2)); logsuccess(` ✓ 清理 registry.json (删除 ${before - after} 个条目)`); } } } catch (err) { logerror(` ✗ 清理 registry.json 失败: ${err.message}`); } } console.log(''); } } /** * 主函数 */ function main() { const args = process.argv.slice(2); const isclean = args.includes('--clean'); const skillarg = args.find(arg => arg.startswith('--skill=')); const specificskill = skillarg ? sk[redacted]('=')[1] : null; logsection('本地 skill 测试工具'); // 检测项目目录 const packageroot = path.join(__dirname, '..'); const packagedskillsdir = path.join(packageroo

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/local-test.jsView on unpkg

scripts/push.shView file

•path = scripts/push.sh kind = build_helper sizeBytes = 6312 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/push.shView on unpkg