Loading npm security reports…

openyida@2026.7.14-2: AI-agent control-surface risk | LPM Firewall

registry / openyida / 2026.7.14-2

openyida@2026.7.14-2

OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）

AI Security Review

scanned 17d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently modifies multiple AI-agent skill/control surfaces. It installs package-supplied skills and auto-enables a local Codex plugin/MCP server when Codex is present.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install / npm install -g

Impact

Foreign AI tools can discover package instructions and invoke the package CLI without a separate user setup action.

Mechanism

Unconsented postinstall AI-agent skill deployment and Codex plugin auto-enablement

Policy narrative

Installing the package executes postinstall.js. It copies its complete skill bundle into Claude unconditionally and into several detected third-party agent directories, replacing existing package-named directories. For Codex it also writes a local marketplace, plugin manifest, MCP configuration pointing at bin/yida.js, and appends enabled plugin configuration. This is unconsented install-time mutation of broad, foreign AI-agent control surfaces.

Rationale

The lifecycle hook establishes and enables agent extensions across unrelated tools at install time, including unconditional Claude mutation and Codex config changes. This meets the install-control-surface block boundary even without observed exfiltration.

Evidence

package.jsonscripts/postinstall.jsyida-skills/skills-index.jsonyida-skills/skills/sls-log-workbench/sls-query.jsyida-skills/~/.claude/skills/yida-skills/~/.codex/skills/yida-skills/~/.codex/config.toml

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

yida-skills/skills/sls-log-workbench/sls-query.jsView file

80try { L81: const openyidaBin = require('child_process') L82: .execSync('which openyida', { encoding: 'utf-8' })

High

Child Process

Package source references child process execution.

yida-skills/skills/sls-log-workbench/sls-query.jsView on unpkg · L80

lib/app/create-form.jsView file

3245var fields = openyidaRuleCollectFields(ctx, event); L3246: return (new Function('value', 'fields', 'event', 'ctx', 'return (' + rule.expression + ');'))(sourceValue, fields, event || {}, ctx); L3247: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/app/create-form.jsView on unpkg · L3245

bin/yida.jsView file

12L13: const { version: currentVersion } = require('../package.json'); L14: const { t } = require('../lib/core/i18n');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yida.jsView on unpkg · L12

lib/feedback/feedback.jsView file

5const crypto = require('crypto'); L6: const { spawnSync } = require('child_process'); L7: ... L47: function printUsage() { L48: process.stderr.write(` L49: 用法: ... L322: function resolveCliPath() { L323: return path.join(__dirname, '..', '..', 'bin', 'yida.js'); L324: } ... L330: env: { L331: ...process.env, L332: YIDA_QUIET: '1',

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/feedback/feedback.jsView on unpkg · L5

scripts/eval/dashboard/server.jsView file

6L7: const http = require('http'); L8: const fs = require('fs'); L9: const path = require('path'); L10: const { spawn } = require('child_process'); L11: ... L13: const HOST = '127.0.0.1'; L14: const PORT = Number(process.env.EVAL_DASHBOARD_PORT || process.argv[2] || 4500); L15:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/eval/dashboard/server.jsView on unpkg · L6

lib/dws/dws-wrapper.jsView file

12L13: const { execSync, spawn } = require('child_process'); L14: const { t } = require('../core/i18n'); ... L18: const INSTALL_SCRIPTS = { L19: unix: 'curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh', L20: windows: 'irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex' ... L28: try { L29: const command = process.platform === 'win32' ? 'where' : 'which'; L30: execSync(`${command} ${DWS_BINARY_NAME}`, { stdio: 'ignore' }); ... L115: input: process.stdin, L116: output: process.stdout L117: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/dws/dws-wrapper.jsView on unpkg · L12

scripts/postinstall.jsView file

11Install-time AI-agent control hijack evidence: L11: * 正确的 skills 安装路径（所有工具统一使用 skills/ 子目录）： L12: * ~/.claude/skills/yida-skills/ ← <package>/yida-skills (copy) L13: * ~/.codex/skills/yida-skills/ ← <package>/yida-skills (copy) L14: * ~/.opencode/skills/yida-skills/ ← <package>/yida-skills (copy) L15: * ~/.aone_copilot/skills/yida-skills/ ← <package>/yida-skills (copy) ... L53: if (!fs.existsSync(src)) {return;} L54: fs.mkdirSync(dest, { recursive: true }); L55: const entries = fs.readdirSync(src, { withFileTypes: true }); ... L61: } else { L62: fs.copyFileSync(srcPath, destPath); L63: } ... L70: function writeJsonFile(filePath, data) { Payload evidence from yida-skills/SKILL.md: L28: L29: **怎么做**：优先跑一次 `openyida agent-capabilities --summary-json`。该 co

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L11

scripts/demo-dws.shView file

•path = scripts/demo-dws.sh kind = build_helper sizeBytes = 3040 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/demo-dws.shView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 34-74json

34 "eval:routing": "node scripts/eval/runner.js --mode routing",

35 "eval:generate": "node scripts/eval/runner.js --mode generate",

36 "eval:all": "node scripts/eval/runner.js --mode all",

37 "eval:dashboard": "node scripts/eval/dashboard/server.js",

38 "test:coverage": "jest --coverage",

39 "lint": "eslint bin/ lib/ scripts/ tests/ --ext .js",

40 "lint:fix": "eslint bin/ lib/ scripts/ tests/ --ext .js --fix",

41 "solution:runner": "node scripts/solution-center-runner.js",

42 "build:skills": "node scripts/build-skills-package.js",

43 "docs:commands": "node scripts/generate-command-docs.js",

44 "check:quick": "npm run check:structure && npm run check:commands && npm run check:docs && npm run check:syntax && npm run lint",

45 "check:structure": "node scripts/validate-structure.js",

46 "check:commands": "node scripts/validate-command-manifest.js",

47 "check:docs": "node scripts/generate-command-docs.js --check",

48 "check:skills": "node scripts/validate-skills.js",

49 "check:syntax": "node scripts/check-syntax.js",

50 "check:package-size": "node scripts/validate-package-size.js",

51 "check:package": "npm pack --dry-run",

52 "check:release": "npm run check:ci",

53 "check:ci": "bash scripts/validate-ci.sh",

54 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 },

56 "keywords": [

57 "yida",

58 "aliwork",

59 "dingtalk",

60 "cli",

61 "openyida",

62 "low-code",

63 "ai",

64 "qoder",

65 "wukong",

66 "mulerun"

67 ],

68 "author": "OpenYida Contributors",

69 "license": "MIT",

70 "repository": {

71 "type": "git",

72 "url": "git+https://github.com/openyida/openyida.git"

73 },

74 "bugs": {

yida-skills/skills/sls-log-workbench/sls-query.jsView file

Lines 60-100javascript

60

61const REFERER_PATH = '/APP_VS2F0YQPOTTCHXNKT16K/workbench/FORM-8392A7A7B3F74D45AC9787AD4C2E4742YZ4H';

62

63const API_MAP = Object.freeze({

64 traceId: [

65 '/query/morning/queryMonitorContextByTraceId.json'

lib/app/create-form.jsView file

Lines 3225-3265javascript

3225 return fields;

3226}

3227

3228function openyidaRuleResolveValue(ctx, rule, sourceValue, event) {

3229 if (Object.prototype

bin/yida.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * openyida - 宜搭命令行工具

4 *

5 * 安装：npm install -g openyida

6 * 用法：openyida <命令> [参数]（别名：yida）

7 *

8 * 命令清单维护在 lib/core/command-manifest.js，供 help 和 agent JSON 共用。

9 */

10

11'use strict';

12

lib/feedback/feedback.jsView file

Lines 1-25javascript

1'use strict';

2

3const fs = require('fs');

4const path = require('path');

5const

scripts/eval/dashboard/server.jsView file

Lines 1-26javascript

1'use strict';

2

3// 零依赖本地 harness 控制台:静态页 + SSE 实时流式运行预定义任务。

4// 启动: node scripts/eval/dashboard/server.js (建议先 nvm use 20)

5// 仅监听 127.0.0.1,任务为白名单固定命令,不接受任意命令注入。

6

7const http = require('http');

8const

lib/dws/dws-wrapper.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 钉钉 CLI (dws) 包装器

4 *

5 * 功能：

6 * 1. 检测并提示安装钉钉 CLI

7 * 2. 透传所有 dws 命令到系统安装的 dws

8 * 3. 提供一键安装指引

9 */

10

11'use strict';

12

scripts/postinstall.jsView file

11Install-time AI-agent control hijack evidence: L11: * 正确的 skills 安装路径（所有工具统一使用 skills/ 子目录）： L12: * ~/.claude/skills/yida-skills/ ← <package>/yida-skills (copy) L13: * ~/.codex/skills/yida-skills/ ← <package>/yida-skills (copy) L14: * ~/.opencode/skills/yida-skills/ ← <package>/yida-skills (copy) L15: * ~/.aone_copilot/skills/yida-skills/ ← <package>/yida-skills (copy) ... L53: if (!fs.existsSync(src)) {return;} L54: fs.mkdirSync(dest, { recursive: true }); L55: const entries = fs.readdirSync(src, { withFileTypes: true }); ... L61: } else { L62: fs.copyFileSync(srcPath, destPath); L63: } ... L70: function writeJsonFile(filePath, data) { Payload evidence from yida-skills/SKILL.md: L28: L29: **怎么做**：优先跑一次 `openyida agent-capabilities --summary-json`。该 co

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L11

scripts/demo-dws.shView file

•path = scripts/demo-dws.sh kind = build_helper sizeBytes = 3040 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/demo-dws.shView on unpkg