registry / @zhushanwen/coding-workflow / 2.2.0
@zhushanwen/coding-workflow@2.2.0
CI for AI coding agents: event-sourced ledger, evidence gates, and a deterministic runner that turns briefs into verified units
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe postinstall hook performs automatic package-owned agent setup by linking bundled content into user-level agent directories. This warrants a warning, while the inspected source does not establish a concrete attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The package’s postinstall hook runs during installation.
Impact
Bundled agent content becomes available to local agent tools after installation. No separate malicious behavior was established in the inspected runtime files.
Mechanism
A shell script creates symlinks for bundled skills and agent files in user-level agent directories; the uninstall hook removes symlinks.
AI rationale
The postinstall hook performs automatic package-owned agent setup by linking bundled content into user-level agent directories. This warrants a warning, while the inspected source does not establish a concrete attack.
Evidence
package.jsonscripts/install-skill.shscripts/uninstall-skill.sh~/.agents/skills~/.claude/skills~/.agents/agents~/.pi/agent/agents~/.claude/agents
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs the skill installer automatically after installation.
- The installer creates symlinks for this package’s skills and agents in user-level agent directories.
- The uninstall script removes symlinks and skips existing regular files.
- The flagged runtime files show process spawning, verification, agent adapters, and explicit backend imports consistent with the package’s coding workflow.
Evidence against
- The inspected sources show no credential collection, external network endpoint, or unrelated consumer project mutation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = bash scripts/install-skill.sh
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = bash scripts/install-skill.sh
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/handlers/run.jsView file
•matchType = normalized_sha256
matchedPackage = @zhushanwen/coding-workflow@2.4.0
matchedPath = dist/handlers/run.js
matchedIdentity = npm:[redacted]:2.4.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
7 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/runner/spawn/lifecycle.js
HighKnown Malware Source Similaritydist/verify/run.js
HighKnown Malware Source Similaritydist/runner/spawn/human.js
HighKnown Malware Source Similaritydist/runner/spawn/pi-rpc.js
HighKnown Malware Source Similaritydist/runner/spawn/pi.js
HighKnown Malware Source Similaritydist/handlers/run.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/handlers/run.js
MediumEnvironment Vars
MediumShips Build Helperscripts/install-skill.sh
Medium
Affected versions and remediation
This report applies to @zhushanwen/coding-workflow@2.2.0.
See all versions of @zhushanwen/coding-workflow for other recorded verdicts.
- Review the evidence and your use of @zhushanwen/coding-workflow@2.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.