Loading npm security reports…

dingtalk-workspace-cli@1.0.63: AI-agent control-surface risk | LPM Firewall

registry / dingtalk-workspace-cli / 1.0.63

dingtalk-workspace-cli@1.0.63

DingTalk Workspace CLI - AI-powered productivity tools

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall hook automatically publishes bundled skills into shared and foreign AI-agent control surfaces without consent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package on a supported platform runs install.js through npm postinstall.

Impact

Package-provided instructions become available to agents outside the CLI, changing their behavior without a separate setup decision.

Mechanism

The installer extracts bundled skills, populates the user's shared agent skill store, and installs links or copies for detected third-party agents.

Policy narrative

Installing the package invokes install.js automatically. Its main function installs bundled skills into the shared agent skill store and detected foreign agent directories without a consent prompt. This places behavior-bearing instructions in control surfaces used by other AI agents. Backup and rollback safeguards protect filesystem transactions but do not provide consent for these changes.

AI rationale

Inspected source proves unconsented postinstall mutation of broad and foreign AI-agent control surfaces. This meets the supplied blocking policy independently of scanner similarity labels or any unproven credential theft.

Evidence

package.jsoninstall.js.agents/skills.claude/skills.openclaw/skills

Decision evidence

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

22["augment", false, ".augment/skills"], ["bob", false, ".bob/skills"], L23: ["claude-code", false, ".claude/skills"], ["openclaw", false, ".openclaw/skills"], L24: ["cline", true, ".agents/skills"], ["codearts-agent", false, ".codeartsdoer/skills"], L25: ["codebuddy", false, ".codebuddy/skills"], ["codemaker", false, ".codemaker/skills"], L26: ["codestudio", false, ".codestudio/skills"], ["codex", true, ".codex/skills"], L27: ["command-code", false, ".commandcode/skills"], ["continue", false, ".continue/skills"], ... L29: ["cursor", true, ".cursor/skills"], ["deepagents", true, ".deepagents/agent/skills"], L30: ["devin", false, ".config/devin/skills"], ["dexto", true, ".agents/skills"], L31: ["droid", false, ".factory/skills"], ["eve", false, null], ... L37: ["iflow-cli", false, ".iflo

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L22

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ls"], ["ona", false, ".ona/skills"], ["pi", false, ".pi/agent/skills"], ["qoder", false, ".qoder/skills"], ["qoder-cn", false, ".qoder-cn/skills"], ["qwen-code", false, ".qwen/skills"], ["replit", true, ".config/agents/skills"], ["reasonix", false, ".reasonix/skills"], ["rovodev", false, ".rovodev/skills"], ["roo", false, ".roo/skills"], ["tabnine-cli", false, ".tabnine/agent/skills"], ["terramind", false, ".terramind/skills"], ["tinycloud", false, ".tinycloud/skills"], ["trae", false, ".trae/skills"], ["trae-cn", false, ".trae-cn/skills"], ["warp", true, ".agents/skills"], ["windsurf", false, ".codeium/windsurf/skills"], ["zed", true, ".agents/skills"], ["zcod

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

install.jsView on unpkg

assets/dws-windows-amd64.zipView file

•path = assets/dws-windows-amd64.zip kind = high_entropy_blob sizeBytes = 20094216 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/dws-windows-amd64.zipView on unpkg

•path = assets/dws-windows-amd64.zip kind = compressed_blob sizeBytes = 20094216 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/dws-windows-amd64.zipView on unpkg

•path = assets/dws-windows-amd64.zip kind = nested_archive_needs_inspection sizeBytes = 20094216 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

assets/dws-windows-amd64.zipView on unpkg

bin/dws.jsView file

•matchType = normalized_sha256 matchedPackage = dingtalk-workspace-cli@1.0.62 matchedPath = bin/dws.js matchedIdentity = npm:ZGluZ3RhbGstd29ya3NwYWNlLWNsaQ:1.0.62 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/dws.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 933a3221fbd0ee74 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = dingtalk-workspace-cli@1.0.62 matchedPath = bin/dws.js matchedIdentity = npm:ZGluZ3RhbGstd29ya3NwYWNlLWNsaQ:1.0.62 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/dws.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 6-38json

6 "repository": {

7 "type": "git",

8 "url": "https://github.com/open-dingtalk/dingtalk-workspace-cli.git"

9 },

10 "homepage": "https://github.com/open-dingtalk/dingtalk-workspace-cli",

11 "bugs": {

12 "url": "https://github.com/open-dingtalk/dingtalk-workspace-cli/issues"

13 },

14 "keywords": [

15 "dingtalk",

16 "dws",

17 "cli",

18 "workspace",

19 "ai",

20 "productivity"

21 ],

22 "bin": {

23 "dws": "./bin/dws.js"

24 },

25 "scripts": {

26 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 },

28 "files": [

29 "assets",

30 "bin",

31 "install.js",

32 "README.md"

33 ],

34 "engines": {

35 "node": ">=16.7.0"

36 }

37}

38

install.jsView file

Lines 2-42javascript

2

3"use strict";

4

5const fs = require("fs");

6const crypto = require("crypto");

7

assets/dws-windows-amd64.zipView file

•path = assets/dws-windows-amd64.zip kind = high_entropy_blob sizeBytes = 20094216 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/dws-windows-amd64.zipView on unpkg

•path = assets/dws-windows-amd64.zip kind = compressed_blob sizeBytes = 20094216 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/dws-windows-amd64.zipView on unpkg

•path = assets/dws-windows-amd64.zip kind = nested_archive_needs_inspection sizeBytes = 20094216 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

assets/dws-windows-amd64.zipView on unpkg

bin/dws.jsView file

•matchType = normalized_sha256 matchedPackage = dingtalk-workspace-cli@1.0.62 matchedPath = bin/dws.js matchedIdentity = npm:ZGluZ3RhbGstd29ya3NwYWNlLWNsaQ:1.0.62 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/dws.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 933a3221fbd0ee74 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = dingtalk-workspace-cli@1.0.62 matchedPath = bin/dws.js matchedIdentity = npm:ZGluZ3RhbGstd29ya3NwYWNlLWNsaQ:1.0.62 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/dws.jsView on unpkg