@yuandc/aica@0.1.58

AICA remote Agent worker

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The flagged persistence and platform checks resolve to private terminal initialization and ordinary path handling. Inspected execution and authentication behavior is consistent with an explicitly started remote agent worker, with no concrete malicious chain established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit CLI start, daemon, or login commands activate the relevant behavior; no automatic npm install hook exists.

Impact

The service can operate local terminals as part of its intended remote worker functionality; no covert persistence or credential harvesting was established.

Mechanism

The worker connects to its configured service and launches interactive shells for terminal requests, using an AICA-owned Bash startup file.

AI rationale

Evidence

.aicaconfig.jsoncredentials.json

Network endpoints1

aca.kinghon.com.cn:8843/

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has only start and help scripts, no install lifecycle hooks or runtime self-dependency.
dist/core/aca-config.js uses platform checks to normalize project paths, not to conceal execution.
dist/core/terminal/shell.js writes a private terminal startup file under the AICA home and passes it through Bash's rcfile option.
dist/core/terminal/service.js implements interactive shell sessions; terminal/worker.js connects to the configured server with its authentication token.
dist/commands/start.js activates the worker through an explicit CLI action.
dist/commands/worker-auth.js obtains the worker token from login to the selected server and stores that server alongside the token.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

4 flagged

dist/core/terminal/shell.jsView file

2Trigger-reachable persistence chain: scripts.start -> dist/worker-cli.js -> dist/commands/start.js -> dist/core/machine-filesystem-worker.js -> dist/core/terminal/service.js -> dist/core/terminal/shell.js L2: __aca_terminal_initial_ps1=\${PS1-} L3: if [[ -r "$HOME/.bashrc" ]]; then L4: . "$HOME/.bashrc" ... L18: unset __aca_terminal_initial_ps1 L19: `;function $(o,l=process.env){const t={...l,TERM:"xterm-256color",COLORTERM:"truecolor"};if(process.platform==="win32"||a.basename(o)!=="bash")return{args:[],env:t};const n=a.join(...

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/terminal/shell.jsView on unpkg · L2

2__aca_terminal_initial_ps1=\${PS1-} L3: if [[ -r "$HOME/.bashrc" ]]; then L4: . "$HOME/.bashrc" ... L18: unset __aca_terminal_initial_ps1 L19: `;function $(o,l=process.env){const t={...l,TERM:"xterm-256color",COLORTERM:"truecolor"};if(process.platform==="win32"||a.basename(o)!=="bash")return{args:[],env:t};const n=a.join(...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/terminal/shell.jsView on unpkg · L2

dist/core/aca-config.js

Findings

3 High5 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/core/aca-config.js

HighTrigger Reachable Persistencedist/core/terminal/shell.js

HighPrevious Version Dangerous Deltadist/core/terminal/service.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/core/terminal/shell.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @yuandc/aica@0.1.58.

See all versions of @yuandc/aica for other recorded verdicts.

Review the evidence and your use of @yuandc/aica@0.1.58 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-03 00:37:14.548Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.