registry / AI-agent capability abuse / aicall-cli-x / 0.0.20

aicall-cli-x@0.0.20

AI 外呼 CLI

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package contains deliberate anti-analysis behavior and an opaque updater that modifies global environments. There is no lifecycle hook, and the behavior is user-command triggered rather than install-time.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs the aicall update command.

Impact

It can alter global Python and npm environments and trust packages selected at update time.

Mechanism

Obfuscated updater that runs package-manager commands and fetches update metadata.

AI rationale

Evidence

dist/bundle.cjs~/.aicallrc/current_version

Network endpoints1

39.96.50.154:8088

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The shipped CLI loads a heavily obfuscated bundle that exits when inspection or debug indicators are present.
The user-invoked update command installs a Python package and multiple npm packages globally.
Update checks use a configurable endpoint with an HTTP IP-address fallback.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The risky installation logic is reached through an explicit CLI update command, not package installation.

Behavioral surface

Source

DynamicRequireFilesystem

Supply chain

HighEntropyStringsMinified

Manifest

NoLicense

scanned 2 file(s), 322 KB of source

Source & flagged code

6 flagged

bin/aicall.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

3/**

4 * AI 外呼 CLI 入口（shim）

5 *

6 * 优先加载混淆后的 dist/bundle.cjs（构建产物），

7 * 不存在时降级到原始源码（开发模式）。

8 */

10import { existsSync } from 'fs';

11import { createRequire } from 'module';

12import { fileURLToPath } from 'url';

13import { dirname, resolve } from 'path';

15const __dirname = dirname(fileURLToPath(import.meta.url));

16const distBundle = resolve(__dirname, '../dist/bundle.cjs');

18if (existsSync(distBundle)) {

19 const require = createRequire(import.meta.url);

20 require(distBundle);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/aicall.jsView on unpkg · L18

21} else {

22 await import('../src/cli.js');

23}

dist/bundle.cjsView file

Lines 1-2javascript

1#!/usr/bin/env node

2(function(){try{var tgh6vOV=typeof process!=='undefined'&&process;if(tgh6vOV&&(tgh6vOV.argv.join(' ').match(/inspect|debug|--dev/

Source & flagged code

6 flagged · loading source

bin/aicall.jsView file

18if (existsSync(distBundle)) { L19: const require = createRequire(import.meta.url); L20: require(distBundle);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/aicall.jsView on unpkg · L18

dist/bundle.cjsView file

1#!/usr/bin/env node L2: (function(){try{var tgh6vOV=typeof process!=='undefined'&&process;if(tgh6vOV&&(tgh6vOV.argv.join(' ').match(/inspect|debug|--dev/)||(tgh6vOV.env.NODE_OPTIONS||'').match(/inspect|de...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/bundle.cjsView on unpkg · L1

2(function(){try{var tgh6vOV=typeof process!=='undefined'&&process;if(tgh6vOV&&(tgh6vOV.argv.join(' ').match(/inspect|debug|--dev/)||(tgh6vOV.env.NODE_OPTIONS||'').match(/inspect|debug/))){tgh6vOV.exit(0);}}catch(WbRE3XZGN){}})();

Medium

Ai Review Evidence

Findings

1 High6 Medium4 Low

HighObfuscated Payload Loaderdist/bundle.cjs

MediumDynamic Requirebin/aicall.js

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/bundle.cjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to aicall-cli-x@0.0.20.

See all versions of aicall-cli-x for other recorded verdicts.

Review the evidence and your use of aicall-cli-x@0.0.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 08:35:54.007Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.