registry / AI-agent capability abuse / base_parts_ai / 1.0.58

base_parts_ai@1.0.58

jaskle base_parts_ai

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No npm lifecycle hook is declared, and the risky behavior is reachable through CLI use. The silent update and remote overwrite of global agent instructions leave concrete residual risk, so this warrants a warning rather than a publish block.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running jcx setapi; the update runs when the fetched configuration reports a newer version, and the AGENTS.md write follows channel configuration.

Impact

The update path can execute a publisher-delivered package, and remote text can change instructions used by Codex. The inspected source does not establish that the remote content is harmful.

Mechanism

The updater accepts the newer version without a consent prompt, installs its tarball, and reruns the CLI. The channel flow fetches ai_tip text and writes it to ~/.codex/AGENTS.md.

AI rationale

Evidence

package.jsonbin/jcx.jslib/ai_utils.jslib/setapi_cx.js~/.codex/AGENTS.md

Network endpoints4

jai.jaskle.cn/hm/hm_pub/ai_cc_cfgjai.jaskle.cn/hm/pub/ai_tipjdwfiles.oss-cn-hangzhou.aliyuncs.com/npm_pkg/base_parts_ai-<newVer>.tgzregistry.npmmirror.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json declares no npm lifecycle hook; `__postinstall` is a custom script entry.
Running the jcx command calls fetchConfig before its selected configuration module.
When the server reports a newer version, the update branch sets confirmation to yes without asking the user.
The updater installs a versioned package tarball globally and reruns the CLI.
After a Codex channel is selected, the program fetches remote ai_tip text from jai.jaskle.cn.
That fetched text is written to the user's global Codex AGENTS.md after channel configuration.

Evidence against

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 116 KB of source, external domains: 127.0.0.1, jai.jaskle.cn, jdwfiles.oss-cn-hangzhou.aliyuncs.com, mirrors.cloud.tencent.com, registry.npmmirror.com

Source & flagged code

7 flagged

bin/jcx.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3'use strict';

5var fs = require('fs');

6var os = require('os');

7var path = require('path');

8var { execSync } = require('child_process');

9var { Command } = require('commander');

High

Child Process

Package source references child process execution.

bin/jcx.jsView on unpkg · L7

11/**

12 * 构建 Codex 配置路径，并确保 ~/.codex 目录存在

13 * @param {object} cmd commander 解析出的选项

14 * @returns {object}

15 */

16function getBuildCfg(cmd) {

17 var buildCfg = {};

18 buildCfg.details = cmd.details;

20 // 从 npm 全局目录下的 @openai/codex/package.json 提取 Codex 版本号

21 // 该版本号用于后续和渠道 cxVersionList 做一致性校验

22 try {

23 var npmRootG = execSync('npm root -g', { encoding: 'utf8' }).trim();

24 var codexPkgPath = path.join(npmRootG, '@openai', 'codex', 'package.json');

25 var codexPkg = JSON.parse(fs.readFileSync(codexPkgPath, 'utf8'));

26 buildCfg.codexVersion = codexPkg.version || '';

27 } catch (e) {

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node 'use strict'; var fs = require('fs'); var os = require('os'); var path = require('path'); var { execsync } = require('child_process'); var { command } = require('commander'); function getbuildcfg(cmd) { var buildcfg = {}; buildcfg.details = cmd.details; try { var npmrootg = execsync('npm root -g', { encoding: 'utf8' }).trim(); var codexpkgpath = path.jo

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/jcx.jsView on unpkg

bin/jgrok.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

3'use strict';

5var os = require('os');

6var path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/ai_utils.jsView file

Lines 1-29javascript

1'use strict';

3/**

4 * Claude 配置工具函数

5 * 供 setapi_cc.js、setapi_cx.js 等命令模块共享使用

6 */

8var fs = require('fs');

9var path =

lib/ucx.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/ucx.js#virtual:normalized:round1View on unpkg

lib/ucx.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = base_parts_ai@1.0.55 matchedIdentity = npm:YmFzZV9wYXJ0c19haQ:1.0.55 similarity = 0.444 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/ucx.jsView on unpkg

Source & flagged code

7 flagged · loading source

bin/jcx.jsView file

7var path = require('path'); L8: var { execSync } = require('child_process'); L9: var { Command } = require('commander');

High

Child Process

Package source references child process execution.

bin/jcx.jsView on unpkg · L7

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/jcx.jsView on unpkg

bin/jgrok.jsView file

Findings

1 Critical6 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltalib/ucx.js

HighChild Processbin/jcx.js

HighShell

HighSandbox Evasion Gated Capabilitylib/ai_utils.js

HighExternal Ai Agent Control Surface Mutationbin/jcx.js

HighRuntime Package Installlib/ai_utils.js

HighSemantic Analysis Limitedlib/ucx.js#virtual:normalized:round1

MediumDynamic Requirebin/jgrok.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to base_parts_ai@1.0.58.

See all versions of base_parts_ai for other recorded verdicts.

Review the evidence and your use of base_parts_ai@1.0.58 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 01:24:10.223Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.