@yuandc/aica@0.1.73

AICA remote Agent worker

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and the flagged file write is limited to interactive terminal setup with user-preserving shell defaults. Daemon persistence requires an explicit CLI action, and the configured default server is package-aligned.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user starts an interactive terminal session or explicitly runs the daemon start command.

Impact

The inspected behavior supports terminal presentation and user-requested background operation; no malicious effect was established.

Mechanism

The terminal helper writes a generated rc file with guarded prompt and ls defaults; the daemon command launches the worker process.

AI rationale

Evidence

dist/core/terminal/shell.jsdist/commands/daemon.js

Network endpoints1

aca.kinghon.com.cn:8843/

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes CLI start and help commands and contains no install lifecycle hook.
dist/core/aca-config.js uses a configurable ACA server URL with the package default https://aca.kinghon.com.cn:8843/.
dist/core/terminal/shell.js defines prompt, color, and ls defaults that preserve existing user settings.
The generated terminal rc file is written under the ACA home only when preparing an interactive Bash session.
dist/core/terminal/service.js launches the configured interactive shell with that rc file.
dist/commands/daemon.js starts the daemon through its explicit CLI start action.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

Source & flagged code

4 flagged

dist/core/terminal/shell.jsView file

2Trigger-reachable persistence chain: scripts.start -> dist/worker-cli.js -> dist/commands/start.js -> dist/core/machine-filesystem-worker.js -> dist/core/terminal/service.js -> dist/core/terminal/shell.js L2: __aca_terminal_initial_ps1=\${PS1-} L3: if [[ -r "$HOME/.bashrc" ]]; then L4: . "$HOME/.bashrc" ... L18: unset __aca_terminal_initial_ps1 L19: `;function $(o,l=process.env){const t={...l,TERM:"xterm-256color",COLORTERM:"truecolor"};if(process.platform==="win32"||a.basename(o)!=="bash")return{args:[],env:t};const n=a.join(...

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/terminal/shell.jsView on unpkg · L2

2__aca_terminal_initial_ps1=\${PS1-} L3: if [[ -r "$HOME/.bashrc" ]]; then L4: . "$HOME/.bashrc" ... L18: unset __aca_terminal_initial_ps1 L19: `;function $(o,l=process.env){const t={...l,TERM:"xterm-256color",COLORTERM:"truecolor"};if(process.platform==="win32"||a.basename(o)!=="bash")return{args:[],env:t};const n=a.join(...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/terminal/shell.jsView on unpkg · L2

dist/core/aca-config.js

Findings

3 High5 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/core/aca-config.js

HighTrigger Reachable Persistencedist/core/terminal/shell.js

HighPrevious Version Dangerous Deltadist/commands/daemon.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/core/terminal/shell.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @yuandc/aica@0.1.73.

See all versions of @yuandc/aica for other recorded verdicts.

Review the evidence and your use of @yuandc/aica@0.1.73 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 11:27:23.324Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.