Loading npm security reports…

openyida@2026.9.3-1: Malicious npm security report (Block) | LPM Firewall

registry / openyida / 2026.9.3-1

openyida@2026.9.3-1

OpenYida CLI - 宜搭低代码 AI 开发工具（安装即用，零配置）

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package automatically modifies multiple AI-agent skill and plugin control surfaces. It can replace skills, enable a Codex marketplace plugin, and ask Codex to install that plugin.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation executes the postinstall lifecycle hook.

Impact

An unconsented package installation can persist package-authored instructions and an MCP-backed plugin in installed AI-agent environments.

Mechanism

Automatic cross-agent skill replacement and Codex plugin installation.

Attack narrative

On npm installation, package.json runs scripts/postinstall.js. That script removes and copies skills into Claude and other AI-agent configuration directories. Where Codex exists, it creates a local marketplace and plugin, enables it in config.toml, and launches `codex plugin add`. These actions modify foreign agent control surfaces during installation without an explicit user command or consent.

Rationale

The automatic postinstall hook broadly mutates foreign AI-agent control surfaces and installs an enabled Codex plugin. This is concrete install-hook abuse under the launcher policy.

Evidence

package.jsonscripts/postinstall.jsyida-skills/~/.claude/skills/yida-skills/~/.codex/skills/yida-skills/~/.codex/config.toml~/.openyida/codex-plugin/~/.opencode/skills/yida-skills/~/.cursor/skills/yida-skills/

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/app/canvas-compile.jsView file

18* }`; L19: * new Function(wrapped)()(window, window); // 取 Comp.YidaComp || Comp.default L20: *

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/app/canvas-compile.jsView on unpkg · L18

bin/yida.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = bin/yida.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/yida.jsView on unpkg

12L13: const { version: currentVersion } = require('../package.json'); L14: const { t } = require('../lib/core/i18n');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yida.jsView on unpkg · L12

lib/feedback/feedback.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/feedback/feedback.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/feedback/feedback.jsView on unpkg

5const crypto = require('crypto'); L6: const { spawnSync } = require('child_process'); L7: ... L47: function printUsage() { L48: process.stderr.write(` L49: 用法: ... L322: function resolveCliPath() { L323: return path.join(__dirname, '..', '..', 'bin', 'yida.js'); L324: } ... L330: env: { L331: ...process.env, L332: YIDA_QUIET: '1',

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/feedback/feedback.jsView on unpkg · L5

lib/dws/dws-wrapper.jsView file

12L13: const { execSync, spawn } = require('child_process'); L14: const { t } = require('../core/i18n'); ... L18: const INSTALL_SCRIPTS = { L19: unix: 'curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh', L20: windows: 'irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex' ... L28: try { L29: const command = process.platform === 'win32' ? 'where' : 'which'; L30: execSync(`${command} ${DWS_BINARY_NAME}`, { stdio: 'ignore' }); ... L115: input: process.stdin, L116: output: process.stdout L117: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/dws/dws-wrapper.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/dws/dws-wrapper.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/dws/dws-wrapper.jsView on unpkg

scripts/postinstall.jsView file

12* folderName 固定为 yida-skills，安装目标始终是 ~/<tool-config>/skills/yida-skills/ L13: * ~/.claude/skills/yida-skills/ ← <package>/yida-skills (copy) L14: * ~/.codex/skills/yida-skills/ ← <package>/yida-skills (copy) L15: * ~/.opencode/skills/yida-skills/ ← <package>/yida-skills (copy) L16: * ~/.cursor/skills/yida-skills/ ← <package>/yida-skills (copy) ... L59: if (!fs.existsSync(src)) {return;} L60: fs.mkdirSync(dest, { recursive: true }); L61: const entries = fs.readdirSync(src, { withFileTypes: true }); ... L67: } else { L68: fs.copyFileSync(srcPath, destPath); L69: } ... L76: function writeJsonFile(filePath, data) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L12

lib/app/page-compat.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 21

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/app/page-compat.js#virtual:normalized:round1View on unpkg

lib/auth/oauth-loopback.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/auth/oauth-loopback.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth/oauth-loopback.jsView on unpkg

lib/core/env-cmd.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/core/env-cmd.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/env-cmd.jsView on unpkg

lib/core/update.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/core/update.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/update.jsView on unpkg

lib/core/utils.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/core/utils.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/utils.jsView on unpkg

lib/auth/token-store.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/auth/token-store.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth/token-store.jsView on unpkg

lib/bridge/bridge.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/bridge/bridge.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/bridge/bridge.jsView on unpkg

lib/core/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/core/doctor.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/core/doctor.jsView on unpkg

lib/app/page-compat.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/app/page-compat.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/app/page-compat.jsView on unpkg

lib/cdn/cdn-refresh.jsView file

•matchType = normalized_sha256 matchedPackage = openyida@2026.9.1-1 matchedPath = lib/cdn/cdn-refresh.js matchedIdentity = npm:b3BlbnlpZGE:2026.9.1-1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cdn/cdn-refresh.jsView on unpkg