Loading npm security reports…

openyida: AI-agent control-surface risk | LPM Firewall

registry / openyida / 2026.8.19-1

openyida@2026.8.19-1

OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates third-party AI-agent configuration without a user command. It replaces skills in Claude and other detected agents, and enables a generated Codex plugin.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install

Impact

Unconsented agent control-surface modification can cause OpenYida skills and MCP commands to be available to AI agents.

Mechanism

postinstall deletion, skill deployment, and AI-agent plugin/config activation

Policy narrative

Installing the package executes a postinstall hook that recursively removes existing yida-skills destinations and copies package-controlled skills into AI-agent directories. It always modifies Claude Code's skills directory and, if Codex is present, generates an OpenYida plugin, creates a local marketplace, and writes enabled=true into Codex configuration. These unconsented install-time mutations target foreign AI-agent control surfaces.

Rationale

The hook performs concrete, automatic mutation of broad third-party AI-agent configuration during npm installation. This meets the firewall block boundary regardless of the absence of observed install-time exfiltration.

Evidence

package.jsonscripts/postinstall.jsyida-skills/~/.claude/skills/yida-skills/~/.codex/skills/yida-skills/~/.codex/config.toml~/.openyida/codex-plugin/

Decision evidence

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/app/canvas-compile.jsView file

18* }`; L19: * new Function(wrapped)()(window, window); // 取 Comp.YidaComp || Comp.default L20: *

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/app/canvas-compile.jsView on unpkg · L18

bin/yida.jsView file

12L13: const { version: currentVersion } = require('../package.json'); L14: const { t } = require('../lib/core/i18n');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yida.jsView on unpkg · L12

lib/feedback/feedback.jsView file

5const crypto = require('crypto'); L6: const { spawnSync } = require('child_process'); L7: ... L47: function printUsage() { L48: process.stderr.write(` L49: 用法: ... L322: function resolveCliPath() { L323: return path.join(__dirname, '..', '..', 'bin', 'yida.js'); L324: } ... L330: env: { L331: ...process.env, L332: YIDA_QUIET: '1',

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/feedback/feedback.jsView on unpkg · L5

lib/dws/dws-wrapper.jsView file

12L13: const { execSync, spawn } = require('child_process'); L14: const { t } = require('../core/i18n'); ... L18: const INSTALL_SCRIPTS = { L19: unix: 'curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh', L20: windows: 'irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex' ... L28: try { L29: const command = process.platform === 'win32' ? 'where' : 'which'; L30: execSync(`${command} ${DWS_BINARY_NAME}`, { stdio: 'ignore' }); ... L115: input: process.stdin, L116: output: process.stdout L117: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/dws/dws-wrapper.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = openyida@2026.8.19 matchedPath = lib/dws/dws-wrapper.js matchedIdentity = npm:b3BlbnlpZGE:2026.8.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/dws/dws-wrapper.jsView on unpkg

scripts/postinstall.jsView file

12* folderName 固定为 yida-skills，安装目标始终是 ~/<tool-config>/skills/yida-skills/ L13: * ~/.claude/skills/yida-skills/ ← <package>/yida-skills (copy) L14: * ~/.codex/skills/yida-skills/ ← <package>/yida-skills (copy) L15: * ~/.opencode/skills/yida-skills/ ← <package>/yida-skills (copy) L16: * ~/.aone_copilot/skills/yida-skills/ ← <package>/yida-skills (copy) ... L61: if (!fs.existsSync(src)) {return;} L62: fs.mkdirSync(dest, { recursive: true }); L63: const entries = fs.readdirSync(src, { withFileTypes: true }); ... L69: } else { L70: fs.copyFileSync(srcPath, destPath); L71: } ... L78: function writeJsonFile(filePath, data) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L12

scripts/demo-dws.shView file

•path = scripts/demo-dws.sh kind = build_helper sizeBytes = 3040 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/demo-dws.shView on unpkg

scripts/validate-structure.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/validate-structure.jsView on unpkg

lib/auth/oauth-loopback.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.8.19 matchedPath = lib/auth/oauth-loopback.js matchedIdentity = npm:b3BlbnlpZGE:2026.8.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth/oauth-loopback.jsView on unpkg

lib/core/env-cmd.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.8.19 matchedPath = lib/core/env-cmd.js matchedIdentity = npm:b3BlbnlpZGE:2026.8.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/env-cmd.jsView on unpkg

lib/app/create-form.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.8.19 matchedPath = lib/app/create-form.js matchedIdentity = npm:b3BlbnlpZGE:2026.8.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/app/create-form.jsView on unpkg

lib/app/publish.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.8.19 matchedPath = lib/app/publish.js matchedIdentity = npm:b3BlbnlpZGE:2026.8.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/app/publish.jsView on unpkg