registry / openyida / 2026.8.28

openyida@2026.8.28

⚠ Under review

OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 27 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 215 file(s), 2.87 MB of source, external domains: 127.0.0.1, api.dingtalk.com, api.example.com, applink.dingtalk.com, attend.dingtalk.com, cdn.example.com, demo.aliwork.com, docs.aliwork.com, dws.company.com, example.com, g.alicdn.com, geo.datav.aliyun.com, github.com, img.alicdn.com, login.dingtalk.com, login.dingtalk.io, openyida.invalid, pixabay.com, raw.githubusercontent.com, registry.npmjs.org, schemas.openxmlformats.org, undraw.co, unsplash.com, www.aliwork.com, www.pexels.com, www.w3.org, www.yidaapps.com, yida-group.alibaba-inc.com, yida.company.com, yidalogin.aliwork.com

Source & flagged code

20 flagged

package.jsonView file

Lines 43-83json

43 "eval:pipeline": "node scripts/eval/runner.js --mode pipeline",

44 "test:coverage": "jest --coverage",

45 "lint": "eslint bin/ lib/ scripts/ tests/ --ext .js",

46 "lint:fix": "eslint bin/ lib/ scripts/ tests/ --ext .js --fix",

47 "solution:runner": "node scripts/solution-center-runner.js",

48 "docs:commands": "node scripts/generate-command-docs.js",

49 "check:quick": "npm run check:structure && npm run check:commands && npm run check:docs && npm run check:i18n && npm run check:syntax && npm run lint",

50 "check:structure": "node scripts/validate-structure.js",

51 "check:commands": "node scripts/validate-command-manifest.js",

52 "check:docs": "node scripts/generate-command-docs.js --check",

53 "check:skills": "node scripts/validate-skills.js",

54 "check:i18n": "node scripts/validate-i18n.js --check",

55 "check:i18n:audit": "node scripts/validate-i18n.js",

56 "check:i18n:baseline": "node scripts/validate-i18n.js --update-baseline",

57 "check:syntax": "node scripts/check-syntax.js",

58 "check:release-risks": "node scripts/check-release-risks.js",

59 "check:package-size": "node scripts/validate-package-size.js",

60 "check:package": "npm pack --dry-run",

61 "check:release": "npm run check:ci",

62 "check:ci": "bash scripts/validate-ci.sh",

63 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L63

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L63

64 },

65 "keywords": [

66 "yida",

67 "aliwork",

68 "dingtalk",

69 "cli",

70 "openyida",

71 "low-code",

72 "ai",

73 "qoder",

74 "mulerun"

75 ],

76 "author": "OpenYida Contributors",

77 "license": "MIT",

78 "repository": {

79 "type": "git",

80 "url": "git+https://github.com/openyida/openyida.git"

81 },

82 "bugs": {

83 "url": "https://github.com/openyida/openyida/issues"

lib/app/canvas-compile.jsView file

Lines 1-38javascript

1'use strict';

3/**

4 * canvas-compile.js - Code Canvas 页面本地编译器

5 *

6 * 把原始 React/JSX/TSX 源码在本地（Node）编译成 Code Canvas 运行态代码

7 * （runtimeCode）+ 依赖清单（importedModules），无需调用任何线上编译服务，

8 * 因此不依赖登录态、不经过风控 WAF。

9 *

10 * ── YidaCodeCanvas 运行方式 ──

11 * 画布物料在浏览器里这样消费 runtimeCode：

bin/yida.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * openyida - 宜搭命令行工具

4 *

5 * 安装：npm install -g openyida

6 * 用法：openyida <命令> [参数]（别名：yida）

7 *

8 * 命令清单维护在 lib/core/command-manifest.js，供 help 和 agent JSON 共用。

9 */

11'use strict';

lib/feedback/feedback.jsView file

Lines 1-25javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

5const

lib/dws/dws-wrapper.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 钉钉 CLI (dws) 包装器

4 *

5 * 功能：

6 * 1. 检测并提示安装钉钉 CLI

7 * 2. 透传所有 dws 命令到系统安装的 dws

8 * 3. 提供一键安装指引

9 */

11'use strict';

scripts/postinstall.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * postinstall hook: skills installation + Codex plugin import + welcome guide after `npm install -g openyida`

4 *

5 * 职责：

6 * 1. 清理旧版本遗留的错误安装（~/.xxx/yida-skills/，缺少 skills/ 中间层级）

7 * 2. 将 yida-skills/ 安装到各 AI 工具的正确 skills 目录

8 * 3. Codex 已安装时，导入本地 Codex 插件，让用户可在 @ 菜单中选择「宜搭」

9 * 4. 首次安装欢迎引导

10 *

11 * 正确的 skills 安装路径（所有工具统一使用 skills/ 子目录）：

lib/app/page-compat.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 21

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/app/page-compat.js#virtual:normalized:round1View on unpkg

lib/auth/oauth-loopback.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.15 matchedPath = lib/auth/oauth-loopback.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth/oauth-loopback.jsView on unpkg

lib/core/env-cmd.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.15 matchedPath = lib/core/env-cmd.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/env-cmd.jsView on unpkg

lib/core/update.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.15 matchedPath = lib/core/update.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/update.jsView on unpkg

lib/core/utils.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.15 matchedPath = lib/core/utils.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/utils.jsView on unpkg

lib/app/create-form.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.8.30 matchedPath = lib/app/create-form.js matchedIdentity = npm:b3BlbnlpZGE:2026.8.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/app/create-form.jsView on unpkg

lib/auth/token-store.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.8.30 matchedPath = lib/auth/token-store.js matchedIdentity = npm:b3BlbnlpZGE:2026.8.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth/token-store.jsView on unpkg

lib/bridge/bridge.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.8.30 matchedPath = lib/bridge/bridge.js matchedIdentity = npm:b3BlbnlpZGE:2026.8.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/bridge/bridge.jsView on unpkg

lib/core/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.15 matchedPath = lib/core/doctor.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/doctor.jsView on unpkg

lib/app/page-compat.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.8.30 matchedPath = lib/app/page-compat.js matchedIdentity = npm:b3BlbnlpZGE:2026.8.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/app/page-compat.jsView on unpkg

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/app/canvas-compile.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.8.30 matchedPath = lib/app/canvas-compile.js matchedIdentity = npm:b3BlbnlpZGE:2026.8.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/app/canvas-compile.js

Findings

1 Critical15 High5 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitylib/dws/dws-wrapper.js

HighSemantic Analysis Limitedlib/app/page-compat.js#virtual:normalized:round1

HighKnown Malware Source Similaritylib/auth/oauth-loopback.js

HighKnown Malware Source Similaritylib/core/env-cmd.js

HighKnown Malware Source Similaritylib/core/update.js

HighKnown Malware Source Similaritylib/core/utils.js

HighKnown Malware Source Similaritylib/dws/dws-wrapper.js

HighKnown Malware Source Similaritylib/app/create-form.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to openyida@2026.8.28.

See all versions of openyida for other recorded verdicts.

Review the evidence and your use of openyida@2026.8.28 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 07:29:03.729Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.