Loading npm security reports…

@yunzhijia/cli@0.1.6: AI-agent control-surface risk | LPM Firewall

registry / @yunzhijia/cli / 0.1.6

@yunzhijia/cli@0.1.6

Yunzhijia (云之家) CLI — manage contacts, documents, calendar events and meeting rooms from the terminal or AI Agent

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package overwrites skills in broad, foreign AI-agent control surfaces. It also downloads and executes an opaque remote native binary during installation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install, including transitive installation that runs postinstall.

Impact

A package installation can alter multiple AI-agent instruction surfaces and run remote code without an explicit setup command.

Mechanism

Automatic agent-skill overwrite plus remote binary download and execution.

Policy narrative

Installing the package invokes its postinstall hook. The hook deletes and replaces a named skill directory across many unrelated AI-agent products, creating a fallback agent directory if none exists. It also retrieves an archive from a remote CDN, extracts a native executable, copies it into the package, and runs it. The checksum is obtained from the same downloaded archive, so it does not establish independent provenance.

AI rationale

This is an unconsented postinstall mutation of broad foreign AI-agent control surfaces, combined with automatic remote native-code execution. It meets the install-hook abuse blocking policy.

Evidence

package.jsonscripts/install.jsskills/yzj-clibin/yzj-cli~/.agents/skills/yzj-cli~/.claude/skills/yzj-cli~/.cursor/skills/yzj-cli~/.gemini/skills/yzj-cli~/.codex/skills/yzj-cli~/.github/skills/yzj-cli

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

21"scripts": { "postinstall": "node ./scripts/install.js", "build:debug": "cargo build",

High

Suspicious Lifecycle Evidence

The package runs scripts/install.js automatically through postinstall.

package.jsonView on unpkg · L21

•scripts.postinstall = node ./scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

28const AGENT_DIRS = [ L29: ".agents/skills", // 兜底：Amp / Kiro / OpenClaw / Augment 等支持 .agents 的工具 L30: ".claude/skills", L31: ".cursor/skills", L32: ".gemini/skills", L33: ".codex/skills", L34: ".github/skills", ... L236: const destBase = path.join(homeDir, agentDir); L237: // 除 .agents/skills 外，父目录不存在则跳过（说明该 IDE 未安装） L238: if (i > 0 && !fs.existsSync(path.dirname(destBase))) continue; ... L240: fs.rmSync(dest, { recursive: true, force: true }); L241: fs.cpSync(skillSrc, dest, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L28

5* L6: * CDN 路径：https://www.yunzhijia.com/mixed/yzj-cli/$platform/$channel/yzj-cli-$version.pak L7: * channel 由 package.json 的 publishConfig.tag 决定：latest 映射为 release，其他 tag 映射为 beta。 L8: * pak 是 zip，内含： ... L21: const path = require("path"); L22: const { execFileSync } = require("child_process"); L23: const os = require("os"); ... L40: L41: const PKG = JSON.parse( L42: fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8") L43: ); ... L45: const CDN_BASE = (

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/install.jsView on unpkg · L5

228const skillSrc = path.join(ROOT_DIR, "skills", "yzj-cli"); if (!fs.existsSync(skillSrc)) return; const homeDir = os.homedir(); let installed = 0; for (let i = 0; i < AGENT_DIRS.length; i++) { const agentDir = AGENT_DIRS[i]; const destBase = path.join(homeDir, agentDir); // 除 .agents/skills 外，父目录不存在则跳过（说明该 IDE 未安装） if (i > 0 && !fs.existsSync(path.dirname(destBase))) continue; const dest = path.join(destBase, "yzj-cli"); fs.rmSync(dest, { recursive: true, force: true }); fs.cpSync(skillSrc, dest, { recurs

High

Ai Review Evidence

The installer overwrites and copies skills into multiple unrelated AI-agent directories under the home directory.

scripts/install.jsView on unpkg · L228