@yuandc/aica@0.1.64
AICA remote Agent worker
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe package has no install hook or confirmed attack behavior, but its opt-in HTTPS mode disables certificate verification while sending a bearer token. Warn about the conditional credential exposure rather than block the package.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the worker with `ACA_SERVER_INSECURE_TLS` set to `1`, `true`, or `yes`.
Impact
A network intermediary may impersonate the server and capture the bearer token.
Mechanism
The HTTPS dispatcher accepts unverified certificates; the server client attaches the configured bearer token to requests sent to the configured server URL.
AI rationale
The package has no install hook or confirmed attack behavior, but its opt-in HTTPS mode disables certificate verification while sending a bearer token. Warn about the conditional credential exposure rather than block the package.
Evidence
dist/core/aca-server-client.js
Network endpoints1
aca.kinghon.com.cn:8843/
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `dist/core/aca-server-client.js` disables TLS certificate verification in its custom HTTPS dispatcher; enabling `ACA_SERVER_INSECURE_TLS` routes HTTPS requests through it.
- `dist/core/aca-server-client.js` sends the configured bearer token to the configured server URL, so opting into insecure TLS can expose that token to an interception attack.
- `package.json` exposes a user-run CLI and defines no install lifecycle hook.
Evidence against
- `dist/core/aca-config.js` defaults the server URL to the package’s stated AICA service; no unrelated recipient is hard-coded.
- The insecure TLS dispatcher is gated by an explicit environment setting, and source inspection found no automatic install-time execution.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
3 flaggeddist/core/terminal/shell.jsView file
2Trigger-reachable persistence chain: scripts.start -> dist/worker-cli.js -> dist/commands/start.js -> dist/core/machine-filesystem-worker.js -> dist/core/terminal/service.js -> dist/core/terminal/shell.js
L2: __aca_terminal_initial_ps1=\${PS1-}
L3: if [[ -r "$HOME/.bashrc" ]]; then
L4: . "$HOME/.bashrc"
...
L18: unset __aca_terminal_initial_ps1
L19: `;function $(o,l=process.env){const t={...l,TERM:"xterm-256color",COLORTERM:"truecolor"};if(process.platform==="win32"||a.basename(o)!=="bash")return{args:[],env:t};const n=a.join(...
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/core/terminal/shell.jsView on unpkg · L22__aca_terminal_initial_ps1=\${PS1-}
L3: if [[ -r "$HOME/.bashrc" ]]; then
L4: . "$HOME/.bashrc"
...
L18: unset __aca_terminal_initial_ps1
L19: `;function $(o,l=process.env){const t={...l,TERM:"xterm-256color",COLORTERM:"truecolor"};if(process.platform==="win32"||a.basename(o)!=="bash")return{args:[],env:t};const n=a.join(...
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/core/terminal/shell.jsView on unpkg · L2dist/core/aca-config.js
Findings
2 High5 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/core/aca-config.js
HighTrigger Reachable Persistencedist/core/terminal/shell.js
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/core/terminal/shell.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @yuandc/aica@0.1.64.
See all versions of @yuandc/aica for other recorded verdicts.
- Review the evidence and your use of @yuandc/aica@0.1.64 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.