@yuandc/aica@0.1.65

AICA remote Agent worker

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The inspected source shows a user-started remote worker whose server communication and local agent execution match its stated package function. The flagged shell-file write is a generated terminal rc file used by interactive bash, and no concrete attack behavior was established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user invokes the start command to run the worker service.

Impact

The inspected behaviors support the package's worker and terminal functions; no concrete malicious behavior was established.

Mechanism

The worker claims jobs from the configured ACA server when a token is available and passes job prompts to the local agent runtime. Its terminal helper creates a generated rc file for interactive bash.

AI rationale

Network endpoints1

aca.kinghon.com.cn:8843/

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes the CLI and defines start and help commands.
The configuration uses the ACA server as its default endpoint.
The terminal helper writes a generated rc file under the ACA home and passes it to interactive bash.
The job worker requires a configured token before claiming jobs from the ACA server and passes received prompts to the agent runtime.
The worker service starts through the user-invoked start command.

Evidence against

The terminal helper writes a shell configuration file, but the inspected code scopes it to an ACA terminal directory and uses it only as bash's rc file.
The worker can run agent jobs and open local terminals, which fits the package's remote worker function and is activated by starting the service.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

4 flagged

dist/core/terminal/shell.jsView file

2Trigger-reachable persistence chain: scripts.start -> dist/worker-cli.js -> dist/commands/start.js -> dist/core/machine-filesystem-worker.js -> dist/core/terminal/service.js -> dist/core/terminal/shell.js L2: __aca_terminal_initial_ps1=\${PS1-} L3: if [[ -r "$HOME/.bashrc" ]]; then L4: . "$HOME/.bashrc" ... L18: unset __aca_terminal_initial_ps1 L19: `;function $(o,l=process.env){const t={...l,TERM:"xterm-256color",COLORTERM:"truecolor"};if(process.platform==="win32"||a.basename(o)!=="bash")return{args:[],env:t};const n=a.join(...

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/terminal/shell.jsView on unpkg · L2

2__aca_terminal_initial_ps1=\${PS1-} L3: if [[ -r "$HOME/.bashrc" ]]; then L4: . "$HOME/.bashrc" ... L18: unset __aca_terminal_initial_ps1 L19: `;function $(o,l=process.env){const t={...l,TERM:"xterm-256color",COLORTERM:"truecolor"};if(process.platform==="win32"||a.basename(o)!=="bash")return{args:[],env:t};const n=a.join(...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/terminal/shell.jsView on unpkg · L2

dist/core/aca-config.js

Findings

3 High5 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/core/aca-config.js

HighTrigger Reachable Persistencedist/core/terminal/shell.js

HighPrevious Version Dangerous Deltadist/core/job-worker.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/core/terminal/shell.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @yuandc/aica@0.1.65.

See all versions of @yuandc/aica for other recorded verdicts.

Review the evidence and your use of @yuandc/aica@0.1.65 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 11:24:54.411Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.