registry / AI-agent control-surface risk / openyida
openyida
OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）
This report shows the evidence for openyida@2026.10.20-2. 38 of 79 known versions are blocked or flagged. The newest version, 2026.10.22, is flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe npm postinstall hook makes unprompted changes to global AI-agent configuration and enables a Codex plugin when that agent is present. This is an active control-surface modification, supporting a publish block under the lifecycle policy.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package through npm runs its postinstall hook.
Impact
Installed agents may load package-provided skills and the enabled plugin in later sessions without the user separately choosing that setup.
Mechanism
The hook copies skills into agent configuration directories, creates a local Codex plugin, and adds an enabled plugin section to Codex configuration.
Policy narrative
During package installation, the postinstall hook writes skills into global agent configuration locations. If Codex is present, it creates a local OpenYida plugin and adds configuration enabling it, then refreshes the plugin installation. These changes occur without an affirmative setup prompt, so later agent sessions may load the package-provided capabilities automatically.
AI rationale
The npm postinstall hook makes unprompted changes to global AI-agent configuration and enables a Codex plugin when that agent is present. This is an active control-surface modification, supporting a publish block under the lifecycle policy.
Evidence
package.jsonscripts/postinstall.jslib/core/doctor.js~/.claude/skills/yida-skills~/.codex/skills/yida-skills~/.codex/config.toml
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs scripts/postinstall.js automatically during installation.
- The hook installs package skills into the home directory’s Claude configuration and, when present, Codex configuration.
- For an existing Codex installation, the hook creates a local plugin and writes configuration that enables it without an affirmative user prompt.
- The hook also installs skills into other detected agent configuration directories, expanding the automatic configuration change beyond Codex.
- The doctor code reads the installed skill from the user’s Claude configuration, consistent with the hook’s global skill installation.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
21 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/app/canvas-compile.jsView file
18* }`;
L19: * new Function(wrapped)()(window, window); // 取 Comp.YidaComp || Comp.default
L20: *
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/app/canvas-compile.jsView on unpkg · L18bin/yida.jsView file
12L13: const { version: currentVersion } = require('../package.json');
L14: const { t } = require('../lib/core/i18n');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/yida.jsView on unpkg · L12lib/feedback/feedback.jsView file
5const crypto = require('crypto');
L6: const { spawnSync } = require('child_process');
L7:
...
L48: function printUsage() {
L49: process.stderr.write(`
L50: 用法:
...
L328: function resolveCliPath() {
L329: return path.join(__dirname, '..', '..', 'bin', 'yida.js');
L330: }
...
L336: env: {
L337: ...process.env,
L338: YIDA_QUIET: '1',
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/feedback/feedback.jsView on unpkg · L5lib/dws/dws-wrapper.jsView file
12L13: const { execSync, spawn } = require('child_process');
L14: const { t } = require('../core/i18n');
...
L18: const INSTALL_SCRIPTS = {
L19: unix: 'curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh',
L20: windows: 'irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex'
...
L28: try {
L29: const command = process.platform === 'win32' ? 'where' : 'which';
L30: execSync(`${command} ${DWS_BINARY_NAME}`, { stdio: 'ignore' });
...
L113: function buildDwsEnv() {
L114: const env = { ...process.env };
L115:
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
lib/dws/dws-wrapper.jsView on unpkg · L12scripts/postinstall.jsView file
12* folderName 固定为 yida-skills，安装目标始终是 ~/<tool-config>/skills/yida-skills/
L13: * ~/.claude/skills/yida-skills/ ← <package>/yida-skills (copy)
L14: * ~/.codex/skills/yida-skills/ ← <package>/yida-skills (copy)
L15: * ~/.opencode/skills/yida-skills/ ← <package>/yida-skills (copy)
L16: * ~/.cursor/skills/yida-skills/ ← <package>/yida-skills (copy)
...
L59: if (!fs.existsSync(src)) {return;}
L60: fs.mkdirSync(dest, { recursive: true });
L61: const entries = fs.readdirSync(src, { withFileTypes: true });
...
L67: } else {
L68: fs.copyFileSync(srcPath, destPath);
L69: }
...
L76: function writeJsonFile(filePath, data) {
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L12•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = scripts/postinstall.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/postinstall.jsView on unpkgyida-skills/skills/yida-design/sub_skill/yida-design-plan/scripts/render_build_plan.pyView file
•path = yida-skills/skills/yida-design/sub_skill/yida-design-plan/scripts/render_build_plan.py
kind = build_helper
sizeBytes = 54540
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
yida-skills/skills/yida-design/sub_skill/yida-design-plan/scripts/render_build_plan.pyView on unpkglib/app/create-form/batch.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/app/create-form/batch.js#virtual:normalized:round1View on unpkglib/auth/oauth-loopback.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = lib/auth/oauth-loopback.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/auth/oauth-loopback.jsView on unpkglib/core/env-cmd.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = lib/core/env-cmd.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/core/env-cmd.jsView on unpkglib/bridge/bridge.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = lib/bridge/bridge.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/bridge/bridge.jsView on unpkglib/core/doctor.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = lib/core/doctor.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/core/doctor.jsView on unpkglib/process/create-process.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = lib/process/create-process.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/process/create-process.jsView on unpkglib/app/page-compat.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = lib/app/page-compat.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/app/page-compat.jsView on unpkglib/asset/asset-resolve.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = lib/asset/asset-resolve.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/asset/asset-resolve.jsView on unpkglib/cdn/cdn-refresh.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = lib/cdn/cdn-refresh.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/cdn/cdn-refresh.jsView on unpkglib/cdn/cdn-upload.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = lib/cdn/cdn-upload.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/cdn/cdn-upload.jsView on unpkglib/core/env-manager.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = lib/core/env-manager.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/core/env-manager.jsView on unpkgyida-skills/skills/yida-canvas-custom-page/scripts/build-canvas-theme.jsView file
•matchType = normalized_sha256
matchedPackage = openyida@2026.9.30
matchedPath = yida-skills/skills/yida-canvas-custom-page/scripts/build-canvas-theme.js
matchedIdentity = npm:b3BlbnlpZGE:2026.9.30
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
yida-skills/skills/yida-canvas-custom-page/scripts/build-canvas-theme.jsView on unpkgFindings
1 Critical15 High6 Medium7 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitylib/dws/dws-wrapper.js
HighSemantic Analysis Limitedlib/app/create-form/batch.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/auth/oauth-loopback.js
HighKnown Malware Source Similaritylib/core/env-cmd.js
HighKnown Malware Source Similarityscripts/postinstall.js
HighKnown Malware Source Similaritylib/bridge/bridge.js
HighKnown Malware Source Similaritylib/core/doctor.js
HighKnown Malware Source Similaritylib/process/create-process.js
HighKnown Malware Source Similaritylib/app/page-compat.js
HighKnown Malware Source Similaritylib/asset/asset-resolve.js
HighKnown Malware Source Similaritylib/cdn/cdn-refresh.js
HighKnown Malware Source Similaritylib/cdn/cdn-upload.js
HighKnown Malware Source Similaritylib/core/env-manager.js
HighKnown Malware Source Similarityyida-skills/skills/yida-canvas-custom-page/scripts/build-canvas-theme.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/yida.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperyida-skills/skills/yida-design/sub_skill/yida-design-plan/scripts/render_build_plan.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvallib/app/canvas-compile.js
LowWeak Cryptolib/feedback/feedback.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to openyida@2026.10.20-2.
The versions list below shows the verdict for each recorded version.
- Avoid installing openyida@2026.10.20-2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
79 known versions2026.10.22latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 22, 2026, 2:00 AM2026.10.20-2shownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 20, 2026, 8:14 AM2026.10.20-1SuspiciousAgent extension lifecycle riskWarnPublishedOct 20, 2026, 5:43 AM2026.10.20SuspiciousAgent extension lifecycle riskWarnPublishedOct 19, 2026, 4:42 PM2026.10.19-4SuspiciousAgent extension lifecycle riskWarnPublishedOct 19, 2026, 1:33 PM2026.10.19-2SuspiciousAgent extension lifecycle riskWarnPublishedOct 19, 2026, 11:52 AM2026.10.19-1SuspiciousAgent extension lifecycle riskWarnPublishedOct 19, 2026, 8:05 AM2026.10.19SuspiciousAgent extension lifecycle riskWarnPublishedOct 19, 2026, 2:56 AM2026.10.18-3SuspiciousAgent extension lifecycle riskWarnPublishedOct 18, 2026, 6:12 AM2026.10.18-2SuspiciousAgent extension lifecycle riskWarnPublishedOct 18, 2026, 4:10 AM2026.10.18-1SuspiciousAgent extension lifecycle riskWarnPublishedOct 18, 2026, 2:30 AM2026.10.16-3SuspiciousAgent extension lifecycle riskWarnPublishedOct 16, 2026, 9:58 AM2026.10.16-2SuspiciousAgent extension lifecycle riskWarnPublishedOct 16, 2026, 8:32 AM2026.10.16-1SuspiciousAgent extension lifecycle riskWarnPublishedOct 16, 2026, 6:40 AM2026.10.16SuspiciousAgent extension lifecycle riskWarnPublishedOct 16, 2026, 3:16 AM2026.10.15-2SuspiciousAgent extension lifecycle riskWarnPublishedOct 15, 2026, 1:54 PM2026.10.15SuspiciousAgent extension lifecycle riskWarnPublishedOct 14, 2026, 6:43 PM2026.10.14-2SuspiciousAgent extension lifecycle riskWarnPublishedOct 14, 2026, 9:51 AM2026.10.14-1SuspiciousAgent extension lifecycle riskWarnPublishedOct 14, 2026, 5:55 AM2026.10.14SuspiciousAgent extension lifecycle riskWarnPublishedOct 14, 2026, 2:08 AM2026.10.13-1SuspiciousAgent extension lifecycle riskWarnPublishedOct 13, 2026, 9:00 AM2026.10.13SuspiciousAgent extension lifecycle riskWarnPublishedOct 13, 2026, 5:41 AM2026.10.12-1SuspiciousAgent extension lifecycle riskWarnPublishedOct 12, 2026, 11:30 AM2026.10.10-1SuspiciousAgent extension lifecycle riskWarnPublishedOct 10, 2026, 8:37 AM2026.10.9SuspiciousAgent extension lifecycle riskWarnPublishedOct 9, 2026, 8:33 AM2026.10.8SuspiciousAgent extension lifecycle riskWarnPublishedOct 8, 2026, 5:49 PM2026.9.30MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 30, 2026, 6:44 AM2026.9.24MaliciousInstall Hook AbuseBlockPublishedSep 24, 2026, 9:16 AM2026.9.23MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 23, 2026, 3:13 PM2026.9.22-1MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 22, 2026, 11:41 AM2026.9.22MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 22, 2026, 6:51 AM2026.9.21SuspiciousAgent extension lifecycle riskWarnPublishedSep 21, 2026, 11:02 AM2026.9.20MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 20, 2026, 8:21 AM2026.9.18-1Scan Failed—AllowUnder ReviewSep 18, 2026, 10:30 AM2026.9.17Scan Failed—AllowUnder ReviewSep 17, 2026, 9:01 AM2026.9.16-2Scan Failed—AllowUnder ReviewSep 16, 2026, 12:36 PM2026.9.16Scan Failed—AllowUnder ReviewSep 16, 2026, 4:06 AM2026.9.15MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 15, 2026, 1:36 PM2026.9.14MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 14, 2026, 10:12 AM2026.9.13MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 13, 2026, 8:33 AM2026.9.12MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 12, 2026, 3:35 PM2026.9.11-3MaliciousInstall Hook AbuseBlockPublishedSep 11, 2026, 10:19 AM2026.9.11-2MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 11, 2026, 7:39 AM2026.9.11-1MaliciousInstall Hook AbuseBlockPublishedSep 11, 2026, 2:55 AM2026.9.10MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 10, 2026, 11:05 AM2026.9.9MaliciousInstall Hook AbuseBlockPublishedSep 9, 2026, 1:27 PM2026.9.8-1MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 8, 2026, 10:47 AM2026.9.8MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 8, 2026, 8:49 AM2026.9.7MaliciousInstall Hook AbuseBlockPublishedSep 7, 2026, 11:19 AM2026.9.4MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 4, 2026, 3:12 PM2026.9.3-1MaliciousInstall Hook AbuseBlockPublishedSep 3, 2026, 10:55 AM2026.9.1-1MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 1, 2026, 9:26 AM2026.9.1MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 1, 2026, 2:13 AM2026.8.31-2MaliciousInstall Hook AbuseBlockPublishedAug 31, 2026, 10:20 AM2026.8.31-1MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 31, 2026, 5:46 AM2026.8.31MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 31, 2026, 2:18 AM2026.8.30MaliciousInstall Hook AbuseBlockPublishedAug 30, 2026, 4:14 AM2026.8.29Scan Failed—AllowUnder ReviewAug 29, 2026, 5:42 AM2026.8.28Scan Failed—AllowUnder ReviewAug 28, 2026, 9:17 AM2026.8.27-2Scan Failed—AllowUnder ReviewAug 27, 2026, 10:54 AM2026.8.27-1MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 27, 2026, 8:41 AM2026.8.27Scan Failed—AllowUnder ReviewAug 27, 2026, 3:40 AM2026.8.26SuspiciousAgent extension lifecycle riskWarnPublishedAug 26, 2026, 12:43 PM2026.8.25-1Scan Failed—AllowUnder ReviewAug 25, 2026, 1:09 PM2026.8.19-1MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 19, 2026, 2:40 AM2026.8.19MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 18, 2026, 5:30 PM2026.8.17-1MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 17, 2026, 10:29 AM2026.8.14SuspiciousAgent extension lifecycle riskWarnPublishedAug 14, 2026, 7:48 AM2026.8.13MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 13, 2026, 2:09 AM2026.8.12MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 12, 2026, 2:43 AM2026.8.11MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 11, 2026, 2:07 AM2026.8.5MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 5, 2026, 1:19 PM2026.7.30MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 30, 2026, 12:13 PM2026.7.21MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 22, 2026, 1:53 AM2026.7.18-2Suspicious—WarnUnder ReviewJul 19, 2026, 3:46 PM2026.7.18-1Suspicious—WarnUnder ReviewJul 18, 2026, 6:10 AM2026.7.14-2MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 14, 2026, 1:34 PM2026.7.13Suspicious—WarnUnder ReviewJul 13, 2026, 10:06 AM2026.7.12Suspicious—WarnUnder ReviewJul 12, 2026, 4:25 AM