@yunkeai/yunke-cli@2.0.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@yunkeai/yunke-cli@2.0.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bundle.jsView file

10`:`[${b[X]}\r L11: ]`;continue}if($+=b[X],b[X]==="\\")o=!0;else if(_&&b[X]==="]")_=!1;else if(!_&&b[X]==="[")_=!0}try{new RegExp($)}catch{return console.warn(`Could not convert regex pattern at ${m.c... L12: `,"utf-8")}catch{}}var G2=(n)=>Ui("info",n),Si=(n)=>Ui("warn",n),t0=(n)=>Ui("error",n);function j$(){return d0(Qn(),".yunke","skill-cache")}function j2(n){return d0(j$(),n)}functio...

High

Child Process

Package source references child process execution.

dist/bundle.jsView on unpkg · L10

1#!/usr/bin/env node L2: import{createRequire as L3}from"node:module";var G3=Object.create;var{getPrototypeOf:M3,defineProperty:rm,getOwnPropertyNames:x3}=Object;var l3=Object.prototype.hasOwnProperty;func... L3: `).join(` ... L10: `:`[${b[X]}\r L11: ]`;continue}if($+=b[X],b[X]==="\\")o=!0;else if(_&&b[X]==="]")_=!1;else if(!_&&b[X]==="[")_=!0}try{new RegExp($)}catch{return console.warn(`Could not convert regex pattern at ${m.c... L12: `,"utf-8")}catch{}}var G2=(n)=>Ui("info",n),Si=(n)=>Ui("warn",n),t0=(n)=>Ui("error",n);function j$(){return d0(Qn(),".yunke","skill-cache")}function j2(n){return d0(j$(),n)}functio...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundle.jsView on unpkg · L1

1#!/usr/bin/env node L2: import{createRequire as L3}from"node:module";var G3=Object.create;var{getPrototypeOf:M3,defineProperty:rm,getOwnPropertyNames:x3}=Object;var l3=Object.prototype.hasOwnProperty;func... L3: `).join(` L4: `+o),n.push($+"m+"+Vm.exports.humanize(this.diff)+"\x1B[0m")}else n[0]=$9()+m+" "+n[0]}function $9(){if(E6.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}functio... L5: `)}function _9(n){if(n)process.env.DEBUG=n;else delete process.env.DEBUG}function J9(){return process.env.DEBUG}function X9(n){n.inspectOpts={};let m=Object.keys(E6.inspectOpts);fo... ... L10: `:`[${b[X]}\r L11: ]`;continue}if($+=b[X],b[X]==="\\")o=!0;else if(_&&b[X]==="]")_=!1;else if(!_&&b[X]==="[")_=!0}try{new RegExp($)}catch{return console.warn(`Could not convert regex patter

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundle.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/bundle.js L1: #!/usr/bin/env node L2: import{createRequire as L3}from"node:module";var G3=Object.create;var{getPrototypeOf:M3,defineProperty:rm,getOwnPropertyNames:x3}=Object;var l3=Object.prototype.hasOwnProperty;func... L3: `).join(` L4: `+o),n.push($+"m+"+Vm.exports.humanize(this.diff)+"\x1B[0m")}else n[0]=$9()+m+" "+n[0]}function $9(){if(E6.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}functio... L5: `)}function _9(n){if(n)process.env.DEBUG=n;else delete process.env.DEBUG}function J9(){return process.env.DEBUG}function X9(n){n.inspectOpts={};let m=Object.keys(E6.inspectOpts);fo... ... L10: `:`[${b[X]}\r L11: ]`;continue}if($+=b[X],b[X]==="\\")o=!0;else if(_&&b[X]==="]")_=!1;else if(!_&&b[X]===

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bundle.jsView on unpkg · L1

10`:`[${b[X]}\r L11: ]`;continue}if($+=b[X],b[X]==="\\")o=!0;else if(_&&b[X]==="]")_=!1;else if(!_&&b[X]==="[")_=!0}try{new RegExp($)}catch{return console.warn(`Could not convert regex pattern at ${m.c... L12: `,"utf-8")}catch{}}var G2=(n)=>Ui("info",n),Si=(n)=>Ui("warn",n),t0=(n)=>Ui("error",n);function j$(){return d0(Qn(),".yunke","skill-cache")}function j2(n){return d0(j$(),n)}functio...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bundle.jsView on unpkg · L10

scripts/postinstall.cjsView file

3const { spawnSync } = require('node:child_process') L4: const { mkdirSync, writeFileSync, existsSync, appendFileSync, readFileSync, readdirSync } = require('node:fs') L5: const { join } = require('node:path') ... L26: try { L27: mkdirSync(join(LOG_FILE, '..'), { recursive: true }) L28: appendFileSync(LOG_FILE, `${new Date().toISOString()} [${level.toUpperCase()}] ${msg}\n`, 'utf-8') L29: } catch { ... L143: if (allRemoved) { L144: mkdirSync(CONFIG_DIR, { recursive: true }) L145: writeFileSync(MARKER, CLEANUP_MARKER_VERSION) L146: logLine('info', `legacy omni-cli cleanup: done, marker ${CLEANUP_MARKER_VERSION} written`) ... L156: // ── 写 sk[redacted]（不含 install_dir；目标列表由 yunke-cli 的 AGENT_DIRS 决定）

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L3

2Cross-file remote execution chain: scripts/postinstall.cjs spawns dist/bundle.js; helper contains network access plus dynamic code execution. L2: L3: const { spawnSync } = require('node:child_process') L4: const { mkdirSync, writeFileSync, existsSync, appendFileSync, readFileSync, readdirSync } = require('node:fs') ... L9: const BUNDLE_PATH = L10: process.env.YUNKE_POSTINSTALL_BUNDLE_OVERRIDE ?? L11: join(__dirname, '..', 'dist', 'bundle.js') L12: ... L20: L21: const API_BASE_URL = process.env.YUNKE_INSTALL_API_URL ?? 'https://sk[redacted]' L22: ... L59: L60: // spawnSync 失败不抛异常（只体现在 status/stderr），rmSync 失败同理；必须回读

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.cjsView on unpkg · L2

Source & flagged code

9 flagged

package.jsonView file

Lines 12-48json

12 ],

13 "publishConfig": {

14 "registry": "https://registry.npmjs.org",

15 "access": "public"

16 },

17 "engines": {

18 "node": ">=18"

19 },

20 "scripts": {

21 "build": "tsc",

22 "build:npm": "bun scripts/build-npm.ts",

23 "build:bin": "bun scripts/build-bin.ts",

24 "build:bin:min": "bun build ./src/index.ts --compile --minify --outfile yunke",

25 "build:bin:darwin-arm64": "bun scripts/build-bin.ts --target=darwin-arm64",

26 "build:bin:darwin-x64": "bun scripts/build-bin.ts --target=darwin-x64",

27 "build:bin:linux": "bun scripts/build-bin.ts --target=linux-x64",

28 "build:bin:windows": "bun scripts/build-bin.ts --target=windows-x64",

29 "build:release": "mkdir -p dist && bun scripts/build-bin.ts",

30 "build:release:upx": "mkdir -p dist && UPX_COMPRESS=1 bun scripts/build-bin.ts",

31 "prepublishOnly": "bun scripts/build-npm.ts",

32 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "dev": "bun run src/index.ts",

34 "test": "bun test"

35 },

36 "dependencies": {

37 "extract-zip": "^2.0.1"

38 },

39 "devDependencies": {

40 "citty": "^0.1.6",

41 "zod": "^3.23.8",

42 "zod-to-json-schema": "^3.23.3",

43 "typescript": "^5.5.3",

44 "@types/node": "^22.0.0",

45 "bun-types": "^1.1.0"

46 }

47}

48

dist/bundle.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2import{createRequire as L3}from"node:module";var G3=Object.create;var{getPrototypeOf:M3,defineProperty:rm,getOwnPropertyNames:x3}=Object;var l3=Object

scripts/postinstall.cjsView file

Lines 1-23javascript

1'use strict'

2

3const { spawnSync } = require('node:child_process')

4const { mkdirSync, writeFileSync, existsSync, appendFileSync, readFileSync, readdirSync