@yunkeai/yunke-cli@2.0.5: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@yunkeai/yunke-cli@2.0.5: AI-agent control-surface risk | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bundle.jsView file

11`:`[${Q[x]}\r L12: ]`;continue}if(X+=Q[x],Q[x]==="\\")J=!0;else if(w&&Q[x]==="]")w=!1;else if(!w&&Q[x]==="[")w=!0}try{new RegExp(X)}catch{return console.warn(`Could not convert regex pattern at ${q.c... L13: ${W.join(`

High

Child Process

Package source references child process execution.

dist/bundle.jsView on unpkg · L11

1#!/usr/bin/env node L2: import{createRequire as gq}from"node:module";var Sq=Object.create;var{getPrototypeOf:bq,defineProperty:O6,getOwnPropertyNames:kq}=Object;var hq=Object.prototype.hasOwnProperty;func... L3: `).join(` ... L11: `:`[${Q[x]}\r L12: ]`;continue}if(X+=Q[x],Q[x]==="\\")J=!0;else if(w&&Q[x]==="]")w=!1;else if(!w&&Q[x]==="[")w=!0}try{new RegExp(X)}catch{return console.warn(`Could not convert regex pattern at ${q.c... L13: ${W.join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundle.jsView on unpkg · L1

1#!/usr/bin/env node L2: import{createRequire as gq}from"node:module";var Sq=Object.create;var{getPrototypeOf:bq,defineProperty:O6,getOwnPropertyNames:kq}=Object;var hq=Object.prototype.hasOwnProperty;func... L3: `).join(` L4: `+J),n.push(X+"m+"+m2.exports.humanize(this.diff)+"\x1B[0m")}else n[0]=uX()+q+" "+n[0]}function uX(){if(U5.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}functio... L5: `)}function ZX(n){if(n)process.env.DEBUG=n;else delete process.env.DEBUG}function pX(){return process.env.DEBUG}function gX(n){n.inspectOpts={};let q=Object.keys(U5.inspectOpts);fo... ... L11: `:`[${Q[x]}\r L12: ]`;continue}if(X+=Q[x],Q[x]==="\\")J=!0;else if(w&&Q[x]==="]")w=!1;else if(!w&&Q[x]==="[")w=!0}try{new RegExp(X)}catch{return console.warn(`Could not convert regex patter

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundle.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/bundle.js L1: #!/usr/bin/env node L2: import{createRequire as gq}from"node:module";var Sq=Object.create;var{getPrototypeOf:bq,defineProperty:O6,getOwnPropertyNames:kq}=Object;var hq=Object.prototype.hasOwnProperty;func... L3: `).join(` L4: `+J),n.push(X+"m+"+m2.exports.humanize(this.diff)+"\x1B[0m")}else n[0]=uX()+q+" "+n[0]}function uX(){if(U5.inspectOpts.hideDate)return"";return new Date().toISOString()+" "}functio... L5: `)}function ZX(n){if(n)process.env.DEBUG=n;else delete process.env.DEBUG}function pX(){return process.env.DEBUG}function gX(n){n.inspectOpts={};let q=Object.keys(U5.inspectOpts);fo... ... L11: `:`[${Q[x]}\r L12: ]`;continue}if(X+=Q[x],Q[x]==="\\")J=!0;else if(w&&Q[x]==="]")w=!1;else if(!w&&Q[x]===

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bundle.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @yunkeai/yunke-cli@2.0.4 matchedPath = dist/bundle.js matchedIdentity = npm:QHl1bmtlYWkveXVua2UtY2xp:2.0.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundle.jsView on unpkg

11`:`[${Q[x]}\r L12: ]`;continue}if(X+=Q[x],Q[x]==="\\")J=!0;else if(w&&Q[x]==="]")w=!1;else if(!w&&Q[x]==="[")w=!0}try{new RegExp(X)}catch{return console.warn(`Could not convert regex pattern at ${q.c... L13: ${W.join(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bundle.jsView on unpkg · L11

scripts/postinstall.cjsView file

3const { spawnSync } = require('node:child_process') L4: const { mkdirSync, writeFileSync, existsSync, appendFileSync, readFileSync, readdirSync } = require('node:fs') L5: const { join } = require('node:path') ... L26: try { L27: mkdirSync(join(LOG_FILE, '..'), { recursive: true }) L28: appendFileSync(LOG_FILE, `${new Date().toISOString()} [${level.toUpperCase()}] ${msg}\n`, 'utf-8') L29: } catch { ... L143: if (allRemoved) { L144: mkdirSync(CONFIG_DIR, { recursive: true }) L145: writeFileSync(MARKER, CLEANUP_MARKER_VERSION) L146: logLine('info', `legacy omni-cli cleanup: done, marker ${CLEANUP_MARKER_VERSION} written`) ... L156: // ── 写 sk[redacted]（不含 install_dir；目标列表由 yunke-cli 的 AGENT_DIRS 决定）

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L3

77try { L78: spawnSync('npm', ['uninstall', '-g', '@yunkeai/omni-cli'], { stdio: 'inherit', shell: true }) L79: logLine('info', 'legacy omni-cli cleanup: npm uninstall @yunkeai/omni-cli done')

High

Shell

Package source references shell execution.

scripts/postinstall.cjsView on unpkg · L77

2Cross-file remote execution chain: scripts/postinstall.cjs spawns dist/bundle.js; helper contains network access plus dynamic code execution. L2: L3: const { spawnSync } = require('node:child_process') L4: const { mkdirSync, writeFileSync, existsSync, appendFileSync, readFileSync, readdirSync } = require('node:fs') ... L9: const BUNDLE_PATH = L10: process.env.YUNKE_POSTINSTALL_BUNDLE_OVERRIDE ?? L11: join(__dirname, '..', 'dist', 'bundle.js') L12: ... L20: L21: const API_BASE_URL = process.env.YUNKE_INSTALL_API_URL ?? 'https://sk[redacted]' L22: ... L59: L60: // spawnSync 失败不抛异常（只体现在 status/stderr），rmSync 失败同理；必须回读

Source & flagged code

12 flagged

package.jsonView file

Lines 12-49json

12 ],

13 "publishConfig": {

14 "registry": "https://registry.npmjs.org",

15 "access": "public"

16 },

17 "engines": {

18 "node": ">=18"

19 },

20 "scripts": {

21 "build": "tsc",

22 "build:npm": "bun scripts/build-npm.ts",

23 "build:bin": "bun scripts/build-bin.ts",

24 "build:bin:min": "bun build ./src/index.ts --compile --minify --outfile yunke",

25 "build:bin:darwin-arm64": "bun scripts/build-bin.ts --target=darwin-arm64",

26 "build:bin:darwin-x64": "bun scripts/build-bin.ts --target=darwin-x64",

27 "build:bin:linux": "bun scripts/build-bin.ts --target=linux-x64",

28 "build:bin:windows": "bun scripts/build-bin.ts --target=windows-x64",

29 "build:release": "mkdir -p dist && bun scripts/build-bin.ts",

30 "build:release:upx": "mkdir -p dist && UPX_COMPRESS=1 bun scripts/build-bin.ts",

31 "prepublishOnly": "bun scripts/build-npm.ts",

32 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 "dev": "bun run src/index.ts",

34 "test": "bun test --isolate"

35 },

36 "dependencies": {

37 "extract-zip": "^2.0.1",

38 "fflate": "^0.8.3"

39 },

40 "devDependencies": {

41 "citty": "^0.1.6",

42 "zod": "^3.23.8",

43 "zod-to-json-schema": "^3.23.3",

44 "typescript": "^5.5.3",

45 "@types/node": "^22.0.0",

46 "bun-types": "^1.1.0"

47 }

48}

49

dist/bundle.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import{createRequire as gq}from"node:module";var Sq=Object.create;var{getPrototypeOf:bq,defineProperty:O6,getOwnPropertyNames:kq}=Object;var hq=Object.

scripts/postinstall.cjsView file

Lines 1-23javascript

1'use strict'

2

3const { spawnSync } = require('node:child_process')

4const { mkdirSync, writeFileSync, existsSync, appendFileSync, readFileSync, readdirSync

Lines 57-97javascript

57 { env: { ...process.env, NODE_OPTIONS: '' } }

58 )

59

60 // spawnSync 失败不抛异常（只体现在 status/stderr），rmSync 失败同理；必须回读

61 // existsSync 确认真的删掉了，否则会出现"日志写了 removed 但文件还在"的静默失败

62 const forceRmChecked = (p) => {

63 if (!existsSync(p)) return true

64 forceRm(p)

65 if (existsSync(p)) {

66 logLine('warn', `legacy omni-cli cleanup: failed to remove ${p}`)

67 return false

68 }

69 return true

70 }

71

72 logLine('info', 'legacy omni-cli cleanup: start')

73 let allRemoved = true

74 try {

75 // a. 卸默认 npm prefix 里的旧包（best-effort。注意：在 WorkBuddy staging 安装场景下

76 // npm_config_prefix 指向 staging 临时目录，这里等价 no-op；WB 私有 prefix 由 b' 直接删）

77 try {

78 spawnSync('npm', ['uninstall', '-g', '@yunkeai/omni-cli'], { stdio: 'inherit', shell: true })

79 logLine('info', 'legacy omni-cli cleanup: npm uninstall @yunkeai/omni-cli done')

High

Shell

Package source references shell execution.

scripts/postinstall.cjsView on unpkg · L77

80 } catch (e) {

81 logLine('warn', `legacy omni-cli cleanup: npm uninstall failed (best-effort): ${e}`)

82 }

83

84 // b'. WorkBuddy 私有 npm prefix 里的旧包。npm uninstall -g 只作用于默认 prefix 够不到这里，

85 // 直接删包目录 + bin shims。prefix 有两处：binaries/node/cli-connector-packages 和

86 // binaries/node/versions/*（每个 node 版本一个）。只删 omni-cli 及 npm 安装中断留下的

87 // .omni-cli-* 临时目录，绝不碰同 prefix 里正在使用的 @yunkeai/yunke-cli。

88 const WB_HOME = join(HOME, '.workbuddy')

89 if (existsSync(WB_HOME)) {

90 const wbPrefixes = [join(WB_HOME, 'binaries', 'node', 'cli-connector-packages')]

91 const wbVersions = join(WB_HOME, 'binaries', 'node', 'versions')

92 if (existsSync(wbVersions)) {

93 for (const ent of readdirSync(wbVersions, { withFileTypes: true })) {

94 if (ent.isDirectory()) wbPrefixes.push(join(wbVersions, ent.name))

95 }

96 }

97 for (const prefix of wbPrefixes) {