@yunzhijia/cli@0.1.5

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

npm install of @yunzhijia/cli, which runs the postinstall hook.

Installed AI coding agents can pick up the skill without a separate user setup step and start issuing yzj-cli commands, including IM, contacts, calendar, and document actions.

unconsented postinstall write of agent skills plus remote binary install

On npm install, postinstall runs scripts/install.js. That script copies the bundled yzj-cli skill into the user home under many AI-agent skill folders, including Claude, Cursor, Gemini, Codex, GitHub, Windsurf, Cline, Trae, Hermes, and .agents. The .agents path is created even when it did not exist; other agents are written when their parent folder is already present. Agents that load those skills are told to run yzj-cli for IM, contacts, calendar, and documents. The same hook also fetches a native binary from the Yunzhijia CDN and trusts a checksum shipped inside that archive.

Postinstall writes a first-party skill into many foreign AI-agent skill directories under the user home, which is unconsented mutation of a broad agent control surface. README claims of automatic agent setup do not make that install-time write consented.