base_parts_ai@1.0.56
jaskle base_parts_ai
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe automatic updater bypasses its apparent confirmation step and installs a server-selected release globally when the CLI is run. This is a concrete conditional remote code execution risk, but the inspected source does not prove an active attack, so the appropriate result is a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI command that calls fetchConfig, and the server reports a greater version.
Impact
A malicious or compromised update source could cause package code to be installed and run with the user's privileges; the global package installation also occurs without confirmation.
Mechanism
The code skips interactive confirmation, constructs a tarball URL from the server-provided version, and invokes a global npm install before rerunning the CLI.
AI rationale
The automatic updater bypasses its apparent confirmation step and installs a server-selected release globally when the CLI is run. This is a concrete conditional remote code execution risk, but the inspected source does not prove an active attack, so the appropriate result is a warning.
Evidence
lib/ai_utils.jsbin/jcx.js
Network endpoints3
jai.jaskle.cnjdwfiles.oss-cn-hangzhou.aliyuncs.comregistry.npmmirror.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Running the jcx command calls fetchConfig before its selected configuration action.
- fetchConfig downloads update metadata from jai.jaskle.cn and accepts a server-provided newVer value.
- When newVer is greater than the local version, the confirmation value is hard-coded to yes; the interactive confirmation is commented out.
- The resulting update command installs a tarball whose URL includes newVer globally, then reruns the CLI.
Evidence against
- The updater is reached through an explicitly run CLI command, and the inspected package manifest has no preinstall, install, or postinstall hook.
- The inspected source does not establish that the update server actually returned a malicious version or payload.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcebin/jcx.jsView file
7var path = require('path');
L8: var { execSync } = require('child_process');
L9: var { Command } = require('commander');
High
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
#!/usr/bin/env node
'use strict';
var fs = require('fs');
var os = require('os');
var path = require('path');
var { execsync } = require('child_process');
var { command } = require('commander');
function getbuildcfg(cmd) {
var buildcfg = {};
buildcfg.details = cmd.details;
try {
var npmrootg = execsync('npm root -g', { encoding: 'utf8' }).trim();
var codexpkgpath = path.jo
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/jcx.jsView on unpkg4L5: var fs = require('fs');
L6: var os = require('os');
Medium
Findings
1 Critical6 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltalib/ucx.js
HighChild Processbin/jcx.js
HighShell
HighSandbox Evasion Gated Capabilitylib/ai_utils.js
HighExternal Ai Agent Control Surface Mutationbin/jcx.js
HighRuntime Package Installlib/ai_utils.js
HighSemantic Analysis Limitedlib/ucx.js#virtual:normalized:round1
MediumDynamic Requirebin/jcx.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to base_parts_ai@1.0.56.
See all versions of base_parts_ai for other recorded verdicts.
- Review the evidence and your use of base_parts_ai@1.0.56 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.