registry / AI-agent control-surface risk / apkpub-cli
apkpub-cli
APK 多市场分发 CLI 工具 - 一键发布到华为/小米/OPPO/VIVO/荣耀及自定义渠道
This report shows the evidence for apkpub-cli@0.0.2, the only known version.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection confirms install-time writes into several foreign AI-agent skill directories via postinstall. Under the install-control policy this is concrete unconsented mutation of broad AI-agent control surfaces, so it should be blocked despite no observed exfiltration or remote code execution. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install / pnpm install running package postinstall
Impact
Installs agent-facing instructions/capability docs without an explicit user command, affecting multiple agent platforms if their config dirs exist.
Mechanism
postinstall copies bundled AI-agent skill files into user home agent skill directories
Policy narrative
On install, npm runs scripts/install-skill.mjs. The script detects existing AI-agent config directories in the user's home directory and recursively copies the package's bundled using-apkpub-cli skill into each corresponding skills directory. This is not a remote payload or credential theft path, but it is an unprompted mutation of broad agent control surfaces during package installation.
AI rationale
Static inspection confirms install-time writes into several foreign AI-agent skill directories via postinstall. Under the install-control policy this is concrete unconsented mutation of broad AI-agent control surfaces, so it should be blocked despite no observed exfiltration or remote code execution. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Evidence
package.jsonscripts/install-skill.mjsskills/using-apkpub-cli/SKILL.mddist/apkpub.js~/.agents/skills/using-apkpub-cli~/.cursor/skills/using-apkpub-cli~/.hermes/skills/using-apkpub-cli~/.claude/skills/using-apkpub-cli
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 92.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json defines postinstall: node scripts/install-skill.mjs.
- scripts/install-skill.mjs runs at install time and copies skills/using-apkpub-cli into ~/.agents, ~/.cursor, ~/.hermes, and ~/.claude skills dirs when those config dirs exist.
- scripts/install-skill.mjs also honors APKPUB_SKILL_DIRS to write the skill to arbitrary user-provided directories.
Evidence against
- scripts/install-skill.mjs copies only package-bundled skill files; no download, eval, child_process, or credential harvesting observed there.
- Install script can be skipped with APKPUB_SKIP_SKILL_INSTALL and silently ignores missing agent config dirs.
- dist/apkpub.js is a CLI for APK publishing; network calls use user-supplied store credentials for app-market APIs.
- No prompt injection text or exfiltration logic observed in the inspected install script.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skill.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/apkpub.jsView file
131"client_secret",
L132: "privateKey",
L133: "access_key_secret",
...
L185: if (level === "debug" && !debugMode) return;
L186: const stream = level === "error" ? process.stderr : process.stderr;
L187: stream.write(formatMessage(level, tag, message) + "\n");
L188: }
...
L198: function getConfigRoot(debug = false) {
L199: const base = path.join(os.homedir(), CONFIG_DIR_NAME);
L200: return debug ? path.join(base, "debug") : base;
...
L252: const content = await readFile(filePath, "utf8");
L253: const raw = JSON.parse(content);
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/apkpub.jsView on unpkg · L131scripts/install-skill.mjsView file
Findings
1 Critical1 High3 Medium4 Low
CriticalAi Agent Control Hijackscripts/install-skill.mjs
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/apkpub.js
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to apkpub-cli@0.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing apkpub-cli@0.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.