cbs-cainiao-merchant-cli@0.0.9: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

cbs-cainiao-merchant-cli@0.0.9: AI-agent control-surface risk | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/services/completion-installer.jsView file

26Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/cli.js -> dist/commands/skill.js -> dist/services/completion-installer.js L26: export function detectShell() { L27: const shellPath = process.env['SHELL']; L28: if (!shellPath) ... L35: function rcFileFor(home, shell) { L36: return join(home, shell === 'zsh' ? '.zshrc' : '.bashrc'); L37: } ... L61: } L62: const rcFile = rcFileFor(opts.home ?? homedir(), shell); L63: try {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/services/completion-installer.jsView on unpkg · L26

26export function detectShell() { L27: const shellPath = process.env['SHELL']; L28: if (!shellPath) ... L35: function rcFileFor(home, shell) { L36: return join(home, shell === 'zsh' ? '.zshrc' : '.bashrc'); L37: } ... L61: } L62: const rcFile = rcFileFor(opts.home ?? homedir(), shell); L63: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/services/completion-installer.jsView on unpkg · L26

dist/commands/update.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.8 matchedPath = dist/commands/update.js matchedIdentity = npm:[redacted]:0.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/update.jsView on unpkg

dist/services/update-checker.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.8 matchedPath = dist/services/update-checker.js matchedIdentity = npm:[redacted]:0.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/update-checker.jsView on unpkg

dist/commands/order.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.8 matchedPath = dist/commands/order.js matchedIdentity = npm:[redacted]:0.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/order.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = cbs-cainiao-merchant-cli@0.0.6 matchedIdentity = npm:[redacted]:0.0.6 similarity = 0.469 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/order.jsView on unpkg

dist/commands/claim.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.8 matchedPath = dist/commands/claim.js matchedIdentity = npm:[redacted]:0.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/claim.jsView on unpkg

dist/commands/problem.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.8 matchedPath = dist/commands/problem.js matchedIdentity = npm:[redacted]:0.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/problem.jsView on unpkg

dist/commands/product.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.8 matchedPath = dist/commands/product.js matchedIdentity = npm:[redacted]:0.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/product.jsView on unpkg

dist/commands/service.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.8 matchedPath = dist/commands/service.js matchedIdentity = npm:[redacted]:0.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/service.jsView on unpkg

dist/utils/run-command.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.8 matchedPath = dist/utils/run-command.js matchedIdentity = npm:[redacted]:0.0.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/run-command.jsView on unpkg