Loading npm security reports…

cbs-cainiao-merchant-cli@0.0.8: AI-agent control-surface risk | LPM Firewall

registry / cbs-cainiao-merchant-cli / 0.0.8

cbs-cainiao-merchant-cli@0.0.8

Cbs merchant CLI tool

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs a postinstall hook that changes broad, foreign AI-agent skill directories without an explicit user command. The same path can modify the user's zsh or bash startup file.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall.

Impact

The package can influence multiple installed AI agents and cause its CLI to run through shell completion in future shells.

Mechanism

Automatic AI-agent skill deployment and shell startup-file modification.

Policy narrative

During npm installation, postinstall launches `skill install`. That command detects and writes bundled instructions into multiple AI-agent skill locations, rather than a package-owned location or a target selected by the user. It additionally edits the active shell's rc file to source a completion command. This is an unconsented install-time mutation of broad external AI-agent control surfaces.

Rationale

The automatic lifecycle hook performs broad external AI-agent and shell configuration changes. That concrete install-time control-surface mutation meets the publish-block policy despite no confirmed credential theft or self-dependency.

Evidence

package.jsonscripts/postinstall.jsdist/services/skill-installer.jsdist/services/completion-installer.jsdist/index.jsskill/SKILL.md~/.codex/skills/cbs-cainiao-merchant-cli~/.claude/skills/cbs-cainiao-merchant-cli

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/services/completion-installer.jsView file

26Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/cli.js -> dist/commands/skill.js -> dist/services/completion-installer.js L26: export function detectShell() { L27: const shellPath = process.env['SHELL']; L28: if (!shellPath) ... L35: function rcFileFor(home, shell) { L36: return join(home, shell === 'zsh' ? '.zshrc' : '.bashrc'); L37: } ... L61: } L62: const rcFile = rcFileFor(opts.home ?? homedir(), shell); L63: try {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/services/completion-installer.jsView on unpkg · L26

26export function detectShell() { L27: const shellPath = process.env['SHELL']; L28: if (!shellPath) ... L35: function rcFileFor(home, shell) { L36: return join(home, shell === 'zsh' ? '.zshrc' : '.bashrc'); L37: } ... L61: } L62: const rcFile = rcFileFor(opts.home ?? homedir(), shell); L63: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/services/completion-installer.jsView on unpkg · L26

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView file

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = high_entropy_blob sizeBytes = 18153 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = compressed_blob sizeBytes = 18153 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = nested_archive_needs_inspection sizeBytes = 18153 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

dist/services/update-checker.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.2 matchedPath = dist/services/update-checker.js matchedIdentity = npm:[redacted]:0.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/update-checker.jsView on unpkg

dist/commands/order.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cbs-cainiao-merchant-cli@0.0.6 matchedIdentity = npm:[redacted]:0.0.6 similarity = 0.469 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/order.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 17-57json

17 ],

18 "scripts": {

19 "build": "node scripts/build.js",

20 "tsc": "tsc",

21 "dev": "tsx src/index.ts",

22 "typecheck": "tsc --noEmit",

23 "test": "node --import tsx --test test/*.test.ts",

24 "build:4px:test": "SITE=4px ENV=test npm run build",

25 "build:4px:pre": "SITE=4px ENV=pre npm run build",

26 "build:cainiao:test": "SITE=cainiao ENV=test npm run build",

27 "build:cainiao:pre": "SITE=cainiao ENV=pre npm run build",

28 "package:role-skills": "bash scripts/package-role-skills.sh",

29 "dev:4px:test": "SITE=4px ENV=test npm run build && node dist/index.js skill install",

30 "dev:4px:pre": "SITE=4px ENV=pre npm run build && node dist/index.js skill install",

31 "dev:cainiao:test": "SITE=cainiao ENV=test npm run build && node dist/index.js skill install",

32 "dev:cainiao:pre": "SITE=cainiao ENV=pre npm run build && node dist/index.js skill install",

33 "release": "npm run build && node scripts/publish.js",

34 "release:4px": "SITE=4px ENV=prod npm run release",

35 "release:cainiao": "SITE=cainiao ENV=prod npm run release",

36 "prepublishOnly": "node scripts/guard-publish.js",

37 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 },

39 "publishConfig": {

40 "access": "public",

41 "registry": "https://registry.npmjs.org"

42 },

43 "dependencies": {

44 "axios": "^1.7.0",

45 "chalk": "^5.3.0",

46 "commander": "^12.0.0",

47 "ora": "^9.4.0"

48 },

49 "devDependencies": {

50 "@types/node": "^20.0.0",

51 "tsx": "^4.0.0",

52 "typescript": "^5.9.3"

53 },

54 "engines": {

55 "node": ">=18.0.0"

56 }

57}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/services/completion-installer.jsView file

Lines 6-46javascript

6 * user's shell. Historically that last step was a manual copy-paste from

7 * `--help`, which is easy to skip — this module does it as part of

8 * `<bin> skill install`

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView file

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = high_entropy_blob sizeBytes = 18153 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = compressed_blob sizeBytes = 18153 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = nested_archive_needs_inspection sizeBytes = 18153 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

dist/services/update-checker.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.2 matchedPath = dist/services/update-checker.js matchedIdentity = npm:[redacted]:0.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/update-checker.jsView on unpkg

dist/commands/order.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cbs-cainiao-merchant-cli@0.0.6 matchedIdentity = npm:[redacted]:0.0.6 similarity = 0.469 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/order.jsView on unpkg