registry / openyida / 2026.7.18-2

openyida@2026.7.18-2

⚠ Under review

OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 223 file(s), 4.00 MB of source, external domains: 127.0.0.1, api.dingtalk.com, api.example.com, applink.dingtalk.com, attend.dingtalk.com, cdn.example.com, cdn.jsdelivr.net, demo.aliwork.com, docs.aliwork.com, dws.company.com, esm.sh, example.com, g.alicdn.com, geo.datav.aliyun.com, github.com, images.unsplash.com, img.alicdn.com, login.dingtalk.com, login.dingtalk.io, openyida.ai, pixabay.com, raw.githubusercontent.com, registry.npmjs.org, schemas.openxmlformats.org, undraw.co, unsplash.com, www.aliwork.com, www.pexels.com, www.w3.org, www.yidaapps.com, yida-group.alibaba-inc.com, yida.company.com, yidalogin.aliwork.com

Source & flagged code

8 flagged

package.jsonView file

Lines 41-81json

41 "test:coverage": "jest --coverage",

42 "lint": "eslint bin/ lib/ scripts/ tests/ --ext .js",

43 "lint:fix": "eslint bin/ lib/ scripts/ tests/ --ext .js --fix",

44 "solution:runner": "node scripts/solution-center-runner.js",

45 "build:skills": "node scripts/build-skills-package.js",

46 "docs:commands": "node scripts/generate-command-docs.js",

47 "check:quick": "npm run check:structure && npm run check:commands && npm run check:docs && npm run check:i18n && npm run check:syntax && npm run lint",

48 "check:structure": "node scripts/validate-structure.js",

49 "check:commands": "node scripts/validate-command-manifest.js",

50 "check:docs": "node scripts/generate-command-docs.js --check",

51 "check:skills": "node scripts/validate-skills.js",

52 "check:i18n": "node scripts/validate-i18n.js --check",

53 "check:i18n:audit": "node scripts/validate-i18n.js",

54 "check:i18n:baseline": "node scripts/validate-i18n.js --update-baseline",

55 "check:syntax": "node scripts/check-syntax.js",

56 "check:release-risks": "node scripts/check-release-risks.js",

57 "check:package-size": "node scripts/validate-package-size.js",

58 "check:package": "npm pack --dry-run",

59 "check:release": "npm run check:ci",

60 "check:ci": "bash scripts/validate-ci.sh",

61 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 },

63 "keywords": [

64 "yida",

65 "aliwork",

66 "dingtalk",

67 "cli",

68 "openyida",

69 "low-code",

70 "ai",

71 "qoder",

72 "wukong",

73 "mulerun"

74 ],

75 "author": "OpenYida Contributors",

76 "license": "MIT",

77 "repository": {

78 "type": "git",

79 "url": "git+https://github.com/openyida/openyida.git"

80 },

81 "bugs": {

lib/app/create-form.jsView file

Lines 2826-2866javascript

2826 return fields;

2827}

2828

2829function openyidaRuleResolveValue(ctx, rule, sourceValue, event) {

2830 if (Object.prototype

bin/yida.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * openyida - 宜搭命令行工具

4 *

5 * 安装：npm install -g openyida

6 * 用法：openyida <命令> [参数]（别名：yida）

7 *

8 * 命令清单维护在 lib/core/command-manifest.js，供 help 和 agent JSON 共用。

9 */

11'use strict';

lib/feedback/feedback.jsView file

Lines 1-25javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

5const

lib/dws/dws-wrapper.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 钉钉 CLI (dws) 包装器

4 *

5 * 功能：

6 * 1. 检测并提示安装钉钉 CLI

7 * 2. 透传所有 dws 命令到系统安装的 dws

8 * 3. 提供一键安装指引

9 */

11'use strict';

scripts/postinstall.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * postinstall hook: skills installation + Codex plugin import + welcome guide after `npm install -g openyida`

4 *

5 * 职责：

6 * 1. 清理旧版本遗留的错误安装（~/.xxx/yida-skills/，缺少 skills/ 中间层级）

7 * 2. 将 yida-skills/ 安装到各 AI 工具的正确 skills 目录

8 * 3. Codex 已安装时，导入本地 Codex 插件，让用户可在 @ 菜单中选择「宜搭」

9 * 4. 首次安装欢迎引导

10 *

11 * 正确的 skills 安装路径（所有工具统一使用 skills/ 子目录）：

scripts/demo-dws.shView file

•path = scripts/demo-dws.sh kind = build_helper sizeBytes = 3040 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/demo-dws.shView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code