base_parts_ai@1.0.61
jaskle base_parts_ai
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI performs an unprompted forced global self-update using a version selected by a remote response, creating a concrete remote code execution risk. The update is triggered by user-invoked CLI commands, so the inspected behavior supports a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running a CLI command that calls fetchConfig, including jcx or ucx.
Impact
This can replace the globally installed package with remotely selected code without recipient-specific user confirmation.
Mechanism
The CLI fetches a version from a remote configuration service, treats confirmation as yes, then runs a forced global npm install of the corresponding archive.
AI rationale
The CLI performs an unprompted forced global self-update using a version selected by a remote response, creating a concrete remote code execution risk. The update is triggered by user-invoked CLI commands, so the inspected behavior supports a warning rather than a publish block.
Evidence
lib/ai_utils.jsbin/jcx.jsbin/ucx.js
Network endpoints3
jai.jaskle.cn/hm/hm_pub/ai_cc_cfgjdwfiles.oss-cn-hangzhou.aliyuncs.com/npm_pkg/registry.npmmirror.com
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Running the jcx command calls fetchConfig before its selected configuration action.
- fetchConfig downloads configuration from jai.jaskle.cn and accepts a server-provided version.
- The update confirmation is hardcoded to yes, with the interactive confirmation commented out.
- The updater downloads a package archive and runs a forced global npm install from it.
Evidence against
- The package exposes jcx as a command-line entry point; the update chain runs when a CLI command is invoked, not from an npm lifecycle hook.
- The reviewed Claude settings setup and ucx account-directory behavior do not establish an attack.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcebin/jcx.jsView file
7var path = require('path');
L8: var { execSync } = require('child_process');
L9: var { Command } = require('commander');
High
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
#!/usr/bin/env node
'use strict';
var fs = require('fs');
var os = require('os');
var path = require('path');
var { execsync } = require('child_process');
var { command } = require('commander');
function getbuildcfg(cmd) {
var buildcfg = {};
buildcfg.details = cmd.details;
try {
var npmrootg = execsync('npm root -g', { encoding: 'utf8' }).trim();
var codexpkgpath = path.jo
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
bin/jcx.jsView on unpkgbin/jgrok.jsView file
Findings
1 Critical6 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltalib/ucx.js
HighChild Processbin/jcx.js
HighShell
HighSandbox Evasion Gated Capabilitylib/ai_utils.js
HighExternal Ai Agent Control Surface Mutationbin/jcx.js
HighRuntime Package Installlib/ai_utils.js
HighSemantic Analysis Limitedlib/ucx.js#virtual:normalized:round1
MediumDynamic Requirebin/jgrok.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to base_parts_ai@1.0.61.
See all versions of base_parts_ai for other recorded verdicts.
- Review the evidence and your use of base_parts_ai@1.0.61 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.