Loading npm security reports…

feishu-docs-cli@1.7.1: AI-agent control-surface risk | LPM Firewall

registry / feishu-docs-cli / 1.7.1

feishu-docs-cli@1.7.1

CLI tool for AI Agents to read/write Feishu docs via shell commands

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package silently changes existing AI-agent skill directories. The installed instructions can cause agents to install or invoke this package in later sessions.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation runs the postinstall hook.

Impact

Unconsented persistence in AI-agent control surfaces and a self-promoting execution path.

Mechanism

Automatic deployment of package-controlled agent instructions into home-directory skill surfaces.

Policy narrative

On installation, the postinstall hook imports the synchronizer. It copies the package skill into pre-existing Claude and generic agent skill directories in the user's home directory without an explicit setup command. That skill tells an agent to install feishu-docs-cli globally when unavailable, creating a persistent package-controlled instruction path that can influence future agent actions.

AI rationale

This is an automatic postinstall mutation of foreign AI-agent control surfaces. The copied content promotes installation of the same package, making the behavior a concrete control-hijack chain rather than ordinary CLI setup.

Evidence

package.jsonscripts/postinstall.mjsdist/utils/skill-sync.jsskills/feishu-docs/SKILL.md~/.claude/skills/feishu-docs/SKILL.md~/.agents/skills/feishu-docs/SKILL.md

Decision evidence

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = feishu-docs-cli@1.6.0 matchedIdentity = npm:ZmVpc2h1LWRvY3MtY2xp:1.6.0 similarity = 0.686 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.jsView on unpkg

10import { existsSync } from "node:fs"; L11: import { execFile } from "node:child_process"; L12: import { CliError } from "./utils/errors.js";

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = feishu-docs-cli@1.8.0 matchedPath = dist/auth.js matchedIdentity = npm:ZmVpc2h1LWRvY3MtY2xp:1.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth.jsView on unpkg

dist/utils/version.jsView file

•matchType = normalized_sha256 matchedPackage = feishu-docs-cli@1.8.0 matchedPath = dist/utils/version.js matchedIdentity = npm:ZmVpc2h1LWRvY3MtY2xp:1.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/version.jsView on unpkg

15export function getLocalVersion() { L16: const require = createRequire(import.meta.url); L17: const pkg = require("../../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/version.jsView on unpkg · L15

dist/auth.js#virtual:normalized:round1View file

183const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/auth.js#virtual:normalized:round1View on unpkg · L183

183const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/auth.js#virtual:normalized:round1View on unpkg · L183

183Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js -> dist/commands/authorize.js -> dist/auth.js L183: const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

dist/utils/skill-sync.jsView file

24{ L25: parentDir: join(home, ".claude", "skills"), L26: filePath: join(home, ".claude", "skills", "feishu-docs", "SKILL.md"), L27: canonical: true, ... L29: { L30: parentDir: join(home, ".agents", "skills"), L31: filePath: join(home, ".agents", "skills", "feishu-docs", "SKILL.md"), L32: canonical: false, ... L81: } L82: await mkdir(dirname(target.filePath), { recursive: true }); L83: await writeFile(target.filePath, source, "utf-8");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/utils/skill-sync.jsView on unpkg · L24

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { readfile, writefile, mkdir, stat } from "node:fs/promises"; import { homedir } from "node:os"; import { dirname, join, resolve } from "node:path"; import { fileurltopath } from "node:url"; const __dirname = dirname(fileurltopath(import.meta.url)); const skill_source = resolve(__dirname, "../../skills/feishu-docs/skill.md"); const disable_env = "feishu_docs_no_skill_sync"; function gettargets(home) { return [ { parentdir: join(home, ".claude", "skills"), filepath: join(home, ".claude", "skills", "feishu-d

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/utils/skill-sync.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 6-46json

6 "bin": {

7 "feishu-docs": "./bin/feishu-docs.js"

8 },

9 "main": "./dist/cli.js",

10 "types": "./dist/cli.d.ts",

11 "files": [

12 "bin/",

13 "dist/",

14 "scripts/",

15 "skills/",

16 "README.md",

17 "README.zh.md",

18 "LICENSE"

19 ],

20 "scripts": {

21 "build": "tsc",

22 "build:check": "tsc --noEmit",

23 "pretest": "npm run build:check",

24 "test": "tsx --test test/*.test.ts",

25 "lint:dead-code": "knip",

26 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "prepublishOnly": "npm run build"

28 },

29 "repository": {

30 "type": "git",

31 "url": "git+https://github.com/cliff-byte/feishu-docs-cli.git"

32 },

33 "keywords": [

34 "feishu",

35 "lark",

36 "cli",

37 "docs",

38 "ai-agent",

39 "claude",

40 "codex"

41 ],

42 "author": "cliff-byte",

43 "license": "MIT",

44 "bugs": {

45 "url": "https://github.com/cliff-byte/feishu-docs-cli/issues"

46 },

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = feishu-docs-cli@1.6.0 matchedIdentity = npm:ZmVpc2h1LWRvY3MtY2xp:1.6.0 similarity = 0.686 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.jsView on unpkg

10import { existsSync } from "node:fs"; L11: import { execFile } from "node:child_process"; L12: import { CliError } from "./utils/errors.js";

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = feishu-docs-cli@1.8.0 matchedPath = dist/auth.js matchedIdentity = npm:ZmVpc2h1LWRvY3MtY2xp:1.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/auth.jsView on unpkg

dist/utils/version.jsView file

Lines 1-35javascript

1/**

2 * Version display and update check utilities.

3 */

4import { readFile, writeFile, mkdir } from "node:fs/promises";

5import { join } from "node:path";

6import { homedir } from "node:os";

dist/auth.js#virtual:normalized:round1View file

183const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/auth.js#virtual:normalized:round1View on unpkg · L183

183const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/auth.js#virtual:normalized:round1View on unpkg · L183

183Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js -> dist/commands/authorize.js -> dist/auth.js L183: const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

dist/utils/skill-sync.jsView file

Lines 4-44javascript

4 * Keeps the Claude-side copies of the feishu-docs skill in step with the

5 * `skills/feishu-docs/SKILL.md` that ships inside this package. Used by three

6 * call sites: the npm