registry / openyida / 2026.7.13

openyida@2026.7.13

⚠ Under review

OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 198 file(s), 3.30 MB of source, external domains: 127.0.0.1, api.dingtalk.com, api.example.com, applink.dingtalk.com, attend.dingtalk.com, cdn.example.com, cdn.jsdelivr.net, demo.aliwork.com, docs.aliwork.com, dws.company.com, esm.sh, example.com, g.alicdn.com, geo.datav.aliyun.com, github.com, img.alicdn.com, login.dingtalk.com, login.dingtalk.io, login.example.test, openyida.ai, raw.githubusercontent.com, registry.npmjs.org, schemas.openxmlformats.org, www.aliwork.com, www.w3.org, www.yidaapps.com, yida-group.alibaba-inc.com, yida.company.com, yidalogin.aliwork.com

Source & flagged code

10 flagged

package.jsonView file

Lines 34-74json

34 "eval:routing": "node scripts/eval/runner.js --mode routing",

35 "eval:generate": "node scripts/eval/runner.js --mode generate",

36 "eval:all": "node scripts/eval/runner.js --mode all",

37 "eval:dashboard": "node scripts/eval/dashboard/server.js",

38 "test:coverage": "jest --coverage",

39 "lint": "eslint bin/ lib/ scripts/ tests/ --ext .js",

40 "lint:fix": "eslint bin/ lib/ scripts/ tests/ --ext .js --fix",

41 "solution:runner": "node scripts/solution-center-runner.js",

42 "build:skills": "node scripts/build-skills-package.js",

43 "docs:commands": "node scripts/generate-command-docs.js",

44 "check:quick": "npm run check:structure && npm run check:commands && npm run check:docs && npm run check:syntax && npm run lint",

45 "check:structure": "node scripts/validate-structure.js",

46 "check:commands": "node scripts/validate-command-manifest.js",

47 "check:docs": "node scripts/generate-command-docs.js --check",

48 "check:skills": "node scripts/validate-skills.js",

49 "check:syntax": "node scripts/check-syntax.js",

50 "check:package-size": "node scripts/validate-package-size.js",

51 "check:package": "npm pack --dry-run",

52 "check:release": "npm run check:ci",

53 "check:ci": "bash scripts/validate-ci.sh",

54 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 },

56 "keywords": [

57 "yida",

58 "aliwork",

59 "dingtalk",

60 "cli",

61 "openyida",

62 "low-code",

63 "ai",

64 "qoder",

65 "wukong",

66 "mulerun"

67 ],

68 "author": "OpenYida Contributors",

69 "license": "MIT",

70 "repository": {

71 "type": "git",

72 "url": "git+https://github.com/openyida/openyida.git"

73 },

74 "bugs": {

yida-skills/skills/sls-log-workbench/sls-query.jsView file

Lines 60-100javascript

61const REFERER_PATH = '/APP_VS2F0YQPOTTCHXNKT16K/workbench/FORM-8392A7A7B3F74D45AC9787AD4C2E4742YZ4H';

63const API_MAP = Object.freeze({

64 traceId: [

65 '/query/morning/queryMonitorContextByTraceId.json'

lib/app/create-form.jsView file

Lines 3225-3265javascript

3225 return fields;

3226}

3227

3228function openyidaRuleResolveValue(ctx, rule, sourceValue, event) {

3229 if (Object.prototype

bin/yida.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * openyida - 宜搭命令行工具

4 *

5 * 安装：npm install -g openyida

6 * 用法：openyida <命令> [参数]（别名：yida）

7 *

8 * 命令清单维护在 lib/core/command-manifest.js，供 help 和 agent JSON 共用。

9 */

11'use strict';

lib/feedback/feedback.jsView file

Lines 1-25javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

5const

scripts/eval/dashboard/server.jsView file

Lines 1-26javascript

1'use strict';

3// 零依赖本地 harness 控制台:静态页 + SSE 实时流式运行预定义任务。

4// 启动: node scripts/eval/dashboard/server.js (建议先 nvm use 20)

5// 仅监听 127.0.0.1,任务为白名单固定命令,不接受任意命令注入。

7const http = require('http');

8const

lib/dws/dws-wrapper.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 钉钉 CLI (dws) 包装器

4 *

5 * 功能：

6 * 1. 检测并提示安装钉钉 CLI

7 * 2. 透传所有 dws 命令到系统安装的 dws

8 * 3. 提供一键安装指引

9 */

11'use strict';

scripts/postinstall.jsView file

11Install-time AI-agent control hijack evidence: L11: * 正确的 skills 安装路径（所有工具统一使用 skills/ 子目录）： L12: * ~/.claude/skills/yida-skills/ ← <package>/yida-skills (copy) L13: * ~/.codex/skills/yida-skills/ ← <package>/yida-skills (copy) L14: * ~/.opencode/skills/yida-skills/ ← <package>/yida-skills (copy) L15: * ~/.aone_copilot/skills/yida-skills/ ← <package>/yida-skills (copy) ... L53: if (!fs.existsSync(src)) {return;} L54: fs.mkdirSync(dest, { recursive: true }); L55: const entries = fs.readdirSync(src, { withFileTypes: true }); ... L61: } else { L62: fs.copyFileSync(srcPath, destPath); L63: } ... L70: function writeJsonFile(filePath, data) { Payload evidence from yida-skills/SKILL.md: L149: 3. **发布前本地校验**：native `.oyd.jsx` / `.jsx` 页面发布前跑 `openyida check-pag

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L11

scripts/demo-dws.shView file

•path = scripts/demo-dws.sh kind = build_helper sizeBytes = 3040 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/demo-dws.shView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code