base_parts_ai@1.0.62

jaskle base_parts_ai

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Static inspection found an automatic, server-directed global self-update on CLI use with no effective confirmation prompt. This is a real unresolved risk, but the inspected source does not prove a broader attack chain or establish the payload behavior, so a warning is appropriate.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Invoking a CLI flow that calls fetchConfig when the remote response advertises a newer version.

Impact

A remote version response can cause a global package replacement and execute the updated CLI; the contents and effects of that release are not established by this source inspection.

Mechanism

The code fetches version data, treats confirmation as yes, installs the constructed tarball URL globally with npm, and reruns the CLI.

AI rationale

Evidence

lib/ai_utils.jsbin/jcx.jslib/claude_cli_common.jspackage.json

Network endpoints3

jai.jaskle.cnjdwfiles.oss-cn-hangzhou.aliyuncs.comregistry.npmmirror.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines no standard install lifecycle hook; the configuration fetch and update are reached through CLI commands.
lib/ai_utils.js fetches version data from jai.jaskle.cn during CLI configuration.
When the returned version is newer, lib/ai_utils.js installs a tarball from jdwfiles.oss-cn-hangzhou.aliyuncs.com globally and reruns the CLI; the confirmation prompt is commented out and the decision is hardcoded to yes.
bin/jcx.js and lib/claude_cli_common.js call fetchConfig as part of their command flows, so invoking these CLIs can trigger the update.

Evidence against

No standard preinstall, install, or postinstall hook is defined in package.json.
The update check is reached through CLI invocation, and the inspected source does not establish credential theft, destructive behavior, or a separate agent-control-surface attack.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Source & flagged code

7 flagged

bin/jcx.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3'use strict';

5var fs = require('fs');

6var os = require('os');

7var path = require('path');

8var { execSync } = require('child_process');

9var { Command } = require('commander');

High

Child Process

Package source references child process execution.

bin/jcx.jsView on unpkg · L7

11/**

12 * 构建 Codex 配置路径，并确保 ~/.codex 目录存在

13 * @param {object} cmd commander 解析出的选项

14 * @returns {object}

15 */

16function getBuildCfg(cmd) {

17 var buildCfg = {};

18 buildCfg.details = cmd.details;

20 // 从 npm 全局目录下的 @openai/codex/package.json 提取 Codex 版本号

21 // 该版本号用于后续和渠道 cxVersionList 做一致性校验

22 try {

23 var npmRootG = execSync('npm root -g', { encoding: 'utf8' }).trim();

24 var codexPkgPath = path.join(npmRootG, '@openai', 'codex', 'package.json');

25 var codexPkg = JSON.parse(fs.readFileSync(codexPkgPath, 'utf8'));

26 buildCfg.codexVersion = codexPkg.version || '';

27 } catch (e) {

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node 'use strict'; var fs = require('fs'); var os = require('os'); var path = require('path'); var { execsync } = require('child_process'); var { command } = require('commander'); function getbuildcfg(cmd) { var buildcfg = {}; buildcfg.details = cmd.details; try { var npmrootg = execsync('npm root -g', { encoding: 'utf8' }).trim(); var codexpkgpath = path.jo

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/jcx.jsView on unpkg

bin/jgrok.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

3'use strict';

5var os = require('os');

6var path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/ai_utils.jsView file

Lines 1-29javascript

1'use strict';

3/**

4 * Claude 配置工具函数

5 * 供 setapi_cc.js、setapi_cx.js 等命令模块共享使用

6 */

8var fs = require('fs');

9var path =

lib/ucx.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/ucx.js#virtual:normalized:round1View on unpkg

lib/ucx.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = base_parts_ai@1.0.55 matchedIdentity = npm:YmFzZV9wYXJ0c19haQ:1.0.55 similarity = 0.444 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/ucx.jsView on unpkg

Source & flagged code

7 flagged · loading source

bin/jcx.jsView file

7var path = require('path'); L8: var { execSync } = require('child_process'); L9: var { Command } = require('commander');

High

Child Process

Package source references child process execution.

bin/jcx.jsView on unpkg · L7

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/jcx.jsView on unpkg

bin/jgrok.jsView file

Findings

1 Critical6 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltalib/ucx.js

HighChild Processbin/jcx.js

HighShell

HighSandbox Evasion Gated Capabilitylib/ai_utils.js

HighExternal Ai Agent Control Surface Mutationbin/jcx.js

HighRuntime Package Installlib/ai_utils.js

HighSemantic Analysis Limitedlib/ucx.js#virtual:normalized:round1

MediumDynamic Requirebin/jgrok.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to base_parts_ai@1.0.62.

See all versions of base_parts_ai for other recorded verdicts.

Review the evidence and your use of base_parts_ai@1.0.62 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 21:26:51.581Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.