@yuandc/aica@0.1.27

AICA remote Agent worker

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Inspected source supports ordinary remote worker functionality activated through CLI commands. The flagged daemon and platform checks do not establish malicious behavior, and no install-time attack or unrelated credential recipient was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user invokes login, start, daemon, or session import commands; installation has no lifecycle trigger.

Impact

The activated worker can operate on local projects, but inspected source does not establish malicious execution or covert data theft.

Mechanism

The worker authenticates to its configured ACA server and processes remote jobs and file requests.

AI rationale

Network endpoints1

aca.kinghon.com.cn:8843/

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json defines CLI commands without install lifecycle hooks or a runtime self-dependency.
dist/core/aca-config.js uses platform checks for path normalization, not sandbox evasion.
dist/commands/daemon.js launches the current worker through explicit daemon commands; runtime paths default to ~/.aica.
dist/commands/start.js activates remote worker loops through the start command.
dist/commands/worker-auth.js obtains and stores authentication from the selected ACA server.
dist/core/file-transfer-worker.js resolves real paths and rejects file reads outside the project root.

Evidence against

The authenticated remote worker can execute agent jobs, transfer files, and modify worktrees; these capabilities match its explicitly activated operation.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

4 flagged

dist/core/aca-config.jsView file

1import{readJsonFile as l,writeJsonFile as h}from"./fs.js";import{getAcaConfigPath as f}from"./paths.js";import{randomUUID as I}from"node:crypto";import j from"node:os";import m fro...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/aca-config.jsView on unpkg · L1

1function i(t){const o=process.platform==="win32"?m.win32:m.posix,e=o.normalize(t),c=o.parse(e).root,n=e.length>c.length?e.replace(/[\\/]+$/,""):e;return process.platform==="win32"?n.toLocaleLowerCase("en-US"):n}function R(t){const o=s(),e=o.projects.filter(r=>r.projectId!==t&&r.n

Low

Ai Review Evidence

dist/core/aca-config.js uses platform checks for path normalization, not sandbox evasion.

dist/core/aca-config.jsView on unpkg · L1

dist/commands/daemon.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yuandc/aica@0.1.40 matchedIdentity = npm:QHl1YW5kYy9haWNh:0.1.40 similarity = 0.758 summary = stored previous version shares package body but lacks this dangerous source file

Findings

2 High3 Medium7 Low

HighSandbox Evasion Gated Capabilitydist/core/aca-config.js

HighPrevious Version Dangerous Deltadist/commands/daemon.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/core/aca-config.js

Affected versions and remediation

This report applies to @yuandc/aica@0.1.27.

See all versions of @yuandc/aica for other recorded verdicts.

Review the evidence and your use of @yuandc/aica@0.1.27 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-03 00:36:44.707Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.