registry / openyida / 2026.10.8

openyida@2026.10.8

OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Source confirms an automatic npm postinstall setup that enables this package's own Codex extension when Codex is present, without a consent prompt. The inspected behavior fits the warning category for first-party agent extension lifecycle setup; it does not establish a broader malicious control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with npm when a Codex configuration directory exists.

Impact

The package's agent skills and plugin become available and enabled in Codex without a separate consent prompt.

Mechanism

The hook copies package skills, creates a local plugin and marketplace, adds missing plugin and marketplace entries to Codex configuration, and invokes Codex to refresh the plugin.

AI rationale

Evidence

package.jsonscripts/postinstall.js~/.codex/config.toml~/.openyida/codex-plugin

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs a postinstall script during npm installation.
The postinstall flow checks for an existing Codex directory, then installs skills and imports the package's plugin automatically.
The installer creates a package-owned Codex plugin and updates Codex configuration and marketplace files.
The plugin is registered as installed by default; its setup is guarded by Codex being present, but has no consent prompt in the inspected flow.

Evidence against

The inspected setup is limited to the package's own plugin and marketplace; the source says existing Codex settings are preserved when already configured.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

21 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/app/canvas-compile.jsView file

Lines 1-38javascript

1'use strict';

3/**

4 * canvas-compile.js - Code Canvas 页面本地编译器

5 *

6 * 把原始 React/JSX/TSX 源码在本地（Node）编译成 Code Canvas 运行态代码

7 * （runtimeCode）+ 依赖清单（importedModules），无需调用任何线上编译服务，

8 * 因此不依赖登录态、不经过风控 WAF。

9 *

10 * ── YidaCodeCanvas 运行方式 ──

11 * 画布物料在浏览器里这样消费 runtimeCode：

12 *

13 * const wrapped = `

14 * return function(iframeWindow, parentWindow){

15 * const window = iframeWindow;

16 * ${runtimeCode}

17 * return YidaComp;

18 * }`;

19 * new Function(wrapped)()(window, window); // 取 Comp.YidaComp || Comp.default

20 *

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/app/canvas-compile.jsView on unpkg · L18

21 * 由此推出 runtimeCode 必须满足：

22 * 1) 是 `new Function` 能解析的纯 JS —— 不能含 JSX，也不能含 ESM import/export 语法；

23 * 2) 执行结束时在作用域内留下一个 `YidaComp` 绑定；

24 * 3) 第三方依赖以 `window.<别名>` 形式引用（antd→window.antd、react→window.React …），

25 * 这些 UMD 依赖由画布运行时依据 importedModules 白名单按需注入。

26 *

27 * 因此本地编译 = Babel 把 JSX/TS 转成 JS → 把 import 改写成 window 别名引用、

28 * 把 export default 改写成画布入口 `YidaComp` → UglifyJS 压缩 → 正则抽出依赖包名。

29 */

31const Babel = require('@babel/standalone');

32const globals = require('globals');

33const UglifyJS = require('uglify-js');

34const {

35 assertNoEmojiInArtifactName,

36 assertNoEmojiInText,

37} = require('../core/no-emoji-guard');

38const { CliError, isCliError } = require('../core/cli-error');

bin/yida.jsView file

12L13: const { version: currentVersion } = require('../package.json'); L14: const { t } = require('../lib/core/i18n');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yida.jsView on unpkg · L12

lib/feedback/feedback.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = lib/feedback/feedback.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/feedback/feedback.jsView on unpkg

5const crypto = require('crypto'); L6: const { spawnSync } = require('child_process'); L7: ... L47: function printUsage() { L48: process.stderr.write(` L49: 用法: ... L322: function resolveCliPath() { L323: return path.join(__dirname, '..', '..', 'bin', 'yida.js'); L324: } ... L330: env: { L331: ...process.env, L332: YIDA_QUIET: '1',

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/feedback/feedback.jsView on unpkg · L5

lib/dws/dws-wrapper.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 钉钉 CLI (dws) 包装器

4 *

5 * 功能：

6 * 1. 检测并提示安装钉钉 CLI

7 * 2. 透传所有 dws 命令到系统安装的 dws

8 * 3. 提供一键安装指引

9 */

11'use strict';

scripts/postinstall.jsView file

12* folderName 固定为 yida-skills，安装目标始终是 ~/<tool-config>/skills/yida-skills/ L13: * ~/.claude/skills/yida-skills/ ← <package>/yida-skills (copy) L14: * ~/.codex/skills/yida-skills/ ← <package>/yida-skills (copy) L15: * ~/.opencode/skills/yida-skills/ ← <package>/yida-skills (copy) L16: * ~/.cursor/skills/yida-skills/ ← <package>/yida-skills (copy) ... L59: if (!fs.existsSync(src)) {return;} L60: fs.mkdirSync(dest, { recursive: true }); L61: const entries = fs.readdirSync(src, { withFileTypes: true }); ... L67: } else { L68: fs.copyFileSync(srcPath, destPath); L69: } ... L76: function writeJsonFile(filePath, data) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = scripts/postinstall.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

yida-skills/skills/yida-design/sub_skill/yida-design-plan/scripts/render_build_plan.pyView file

•path = yida-skills/skills/yida-design/sub_skill/yida-design-plan/scripts/render_build_plan.py kind = build_helper sizeBytes = 54540 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

yida-skills/skills/yida-design/sub_skill/yida-design-plan/scripts/render_build_plan.pyView on unpkg

lib/app/page-compat.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 21

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/app/page-compat.js#virtual:normalized:round1View on unpkg

lib/auth/oauth-loopback.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = lib/auth/oauth-loopback.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth/oauth-loopback.jsView on unpkg

lib/core/env-cmd.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = lib/core/env-cmd.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/env-cmd.jsView on unpkg

lib/core/update.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = lib/core/update.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/update.jsView on unpkg

lib/core/utils.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = lib/core/utils.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/utils.jsView on unpkg

lib/app/create-form.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = lib/app/create-form.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/app/create-form.jsView on unpkg

lib/app/create-form/batch.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = lib/app/create-form/batch.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/app/create-form/batch.jsView on unpkg

lib/auth/token-store.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = lib/auth/token-store.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth/token-store.jsView on unpkg

lib/bridge/bridge.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = lib/bridge/bridge.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/bridge/bridge.jsView on unpkg

lib/core/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.30 matchedPath = lib/core/doctor.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/doctor.jsView on unpkg

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/app/canvas-compile.jsView file

18* }`; L19: * new Function(wrapped)()(window, window); // 取 Comp.YidaComp || Comp.default L20: *

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/app/canvas-compile.jsView on unpkg · L18

Findings

1 Critical15 High6 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitylib/dws/dws-wrapper.js

HighSemantic Analysis Limitedlib/app/page-compat.js#virtual:normalized:round1

HighKnown Malware Source Similaritylib/auth/oauth-loopback.js

HighKnown Malware Source Similaritylib/core/env-cmd.js

HighKnown Malware Source Similaritylib/core/update.js

HighKnown Malware Source Similaritylib/core/utils.js

HighKnown Malware Source Similaritylib/dws/dws-wrapper.js

HighKnown Malware Source Similarityscripts/postinstall.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to openyida@2026.10.8.

See all versions of openyida for other recorded verdicts.

Review the evidence and your use of openyida@2026.10.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 17:51:55.537Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code