Loading npm security reports…

@yunzhijia/cli@0.1.7: AI-agent control-surface risk | LPM Firewall

registry / @yunzhijia/cli / 0.1.7

@yunzhijia/cli@0.1.7

Yunzhijia (云之家) CLI — manage contacts, documents, calendar events and meeting rooms from the terminal or AI Agent

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies multiple third-party AI-agent skill control surfaces in the user's home directory. It also fetches and executes a remote binary during installation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall runs when the package is installed.

Impact

A package installation can establish or replace instructions used by several AI-agent tools without an explicit setup command.

Mechanism

Postinstall downloads a binary and forcibly replaces agent skill directories.

Policy narrative

A registry installation invokes scripts/install.js. The script downloads an archive containing an executable, installs it, and runs it for a version check. It then removes and copies a package-provided skill into up to ten AI-agent configuration locations under the user's home directory, including a fallback location it creates. This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces.

AI rationale

The postinstall hook establishes or replaces skills across unrelated AI-agent products without an explicit user setup action. This meets the install-time foreign/broad AI-agent control-surface mutation block policy.

Evidence

package.jsonscripts/install.jsbin/yzj-cli~/.agents/skills/yzj-cli~/.claude/skills/yzj-cli~/.cursor/skills/yzj-cli~/.gemini/skills/yzj-cli~/.codex/skills/yzj-cli

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

28const AGENT_DIRS = [ L29: ".agents/skills", // 兜底：Amp / Kiro / OpenClaw / Augment 等支持 .agents 的工具 L30: ".claude/skills", L31: ".cursor/skills", L32: ".gemini/skills", L33: ".codex/skills", L34: ".github/skills", ... L236: const destBase = path.join(homeDir, agentDir); L237: // 除 .agents/skills 外，父目录不存在则跳过（说明该 IDE 未安装） L238: if (i > 0 && !fs.existsSync(path.dirname(destBase))) continue; ... L240: fs.rmSync(dest, { recursive: true, force: true }); L241: fs.cpSync(skillSrc, dest, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L28

5* L6: * CDN 路径：https://www.yunzhijia.com/mixed/yzj-cli/$platform/$channel/yzj-cli-$version.pak L7: * channel 由 package.json 的 publishConfig.tag 决定：latest 映射为 release，其他 tag 映射为 beta。 L8: * pak 是 zip，内含： ... L21: const path = require("path"); L22: const { execFileSync } = require("child_process"); L23: const os = require("os"); ... L40: L41: const PKG = JSON.parse( L42: fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8") L43: ); ... L45: const CDN_BASE = (

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/install.jsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = @yunzhijia/cli@0.1.5 matchedPath = scripts/install.js matchedIdentity = npm:QHl1bnpoaWppYS9jbGk:0.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 43a941b0c3c30c1f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @yunzhijia/cli@0.1.5 matchedPath = scripts/install.js matchedIdentity = npm:QHl1bnpoaWppYS9jbGk:0.1.5 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/install.jsView on unpkg