openyida@2026.10.20
OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe postinstall hook performs unprompted agent setup, including enabling a Codex plugin, so residual lifecycle risk remains. The source identifies this as a package-owned local plugin and the inspected excerpts do not establish a block-level attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install of openyida; Codex plugin setup runs when ~/.codex exists.
Impact
Agent behavior is extended automatically during package installation, without a separate setup prompt.
Mechanism
Copies package-owned skills, adds an enabled OpenYida plugin and local marketplace to Codex configuration, and invokes Codex's plugin-add command.
AI rationale
The postinstall hook performs unprompted agent setup, including enabling a Codex plugin, so residual lifecycle risk remains. The source identifies this as a package-owned local plugin and the inspected excerpts do not establish a block-level attack.
Evidence
package.jsonscripts/postinstall.jslib/core/doctor.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/postinstall.js automatically after installation.
- The hook always copies skills into the user's Claude directory; when Codex is present, it installs skills and a local OpenYida plugin, then refreshes that plugin.
- The hook enables the OpenYida Codex plugin in config.toml and writes a local marketplace entry without an affirmative setup prompt.
- The Codex plugin setup writes under the user's home directory and invokes Codex's plugin-add command.
- The doctor target only reads installed skill metadata to check its version.
Evidence against
- The Codex setup is conditional on an existing Codex directory and creates a package-owned local marketplace.
- The inspected hook and doctor excerpts show no credential collection or transfer.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
21 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/app/canvas-compile.jsView file
18* }`;
L19: * new Function(wrapped)()(window, window); // 取 Comp.YidaComp || Comp.default
L20: *
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/app/canvas-compile.jsView on unpkg · L18Findings
1 Critical15 High6 Medium7 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitylib/dws/dws-wrapper.js
HighSemantic Analysis Limitedlib/app/create-form/batch.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/auth/oauth-loopback.js
HighKnown Malware Source Similaritylib/core/env-cmd.js
HighKnown Malware Source Similarityscripts/postinstall.js
HighKnown Malware Source Similaritylib/bridge/bridge.js
HighKnown Malware Source Similaritylib/core/doctor.js
HighKnown Malware Source Similaritylib/process/create-process.js
High
Affected versions and remediation
This report applies to openyida@2026.10.20.
See all versions of openyida for other recorded verdicts.
- Review the evidence and your use of openyida@2026.10.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.