registry / publishport-opencli / 1.8.5-pp.25

publishport-opencli@1.8.5-pp.25

Make any website or Electron App your CLI. AI-powered.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface was found. The package has install-time first-party OpenCLI setup and cleanup in the user's home directory, which is agent/platform extension lifecycle risk but not foreign control-surface hijack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

global npm install or explicit OPENCLI_FETCH=1; later user-invoked opencli commands

Impact

Can modify ~/.opencli and shell completion files; user-invoked commands can access authenticated sites through the user's browser session.

Mechanism

first-party OpenCLI home-directory setup, adapter discovery, browser/site automation

Policy narrative

On global install, lifecycle scripts perform OpenCLI setup: completions, a Spotify template, and adapter manifest cleanup in ~/.opencli. Runtime OpenCLI startup creates compatibility shims and discovers built-in plus user-local adapters/plugins. This is broad agent/browser automation capability, but inspected source shows package-aligned behavior rather than credential harvesting, exfiltration, persistence outside OpenCLI, or unconsented mutation of foreign AI-agent control surfaces.

Rationale

The risky primitives are real but tied to the advertised OpenCLI platform and its own ~/.opencli namespace, with no concrete malicious lifecycle delivery or exfiltration found. Because lifecycle code mutates a package-owned agent/adapter surface, warn rather than block.

Evidence

package.jsonscripts/postinstall.jsscripts/fetch-adapters.jsdist/src/main.jsdist/src/discovery.jsdist/src/external.jsdist/src/launcher.jsclis/segmentfault/article.js~/.zsh/completions/_opencli~/.bash_completion.d/opencli~/.config/fish/completions/opencli.fish~/.opencli/spotify.env~/.opencli/clis~/.opencli/adapter-manifest.json~/.opencli/node_modules/@jackwener/opencli

Network endpoints6

127.0.0.1:19825/shutdowngithub.com/jackwener/opencli/releasesdeveloper.spotify.com/dashboardsegmentfault.com/writesegmentfault.com/gateway/imagesegmentfault.com/gateway/article

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines postinstall, preuninstall, prepare, and prepublishOnly lifecycle scripts.
scripts/postinstall.js writes shell completion files and ~/.opencli/spotify.env on global installs.
scripts/fetch-adapters.js can remove stale overrides under ~/.opencli/clis and legacy ~/.opencli shim files.
dist/src/main.js creates ~/.opencli compatibility shims and loads user adapters/plugins from ~/.opencli on CLI startup.

Evidence against

postinstall exits unless npm_config_global=true and skips CI.
scripts/fetch-adapters.js states no network calls and only hashes packaged clis/ files before first-party ~/.opencli cleanup.
No lifecycle writes to foreign AI-agent surfaces such as CLAUDE.md, .mcp.json, Codex/Cursor settings, or shell rc files were found.
Network and browser actions are implemented as user-invoked site adapters, often requiring browser session/auth or explicit --execute for publishing.
clis/segmentfault/article.js mutates XMLHttpRequest only inside page evaluation to reuse SegmentFault signing and posts to segmentfault.com.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

NoLicense

scanned 1,565 file(s), 4.81 MB of source, external domains: 127.0.0.1, 36kr.com, a.example, account.dianping.com, accounts.douban.com, accounts.google.com, accounts.pixiv.net, accounts.spotify.com, admin.xiaoe-tech.com, api.bilibili.com, api.chess.com, api.coingecko.com, api.dictionaryapi.dev, api.fda.gov, api.github.com, api.juejin.cn, api.llama.fi, api.m.jd.com, api.manus.im, api.npmjs.org, api.nuget.org, api.openalex.org, api.osv.dev, api.ruguoapp.com, api.semanticscholar.org, api.slock.ai, api.spotify.com, api.stackexchange.com, api.tvmaze.com, api.vc.bilibili.com, api.xiaoyuzhoufm.com, api.zhihu.com, api.zsxq.com, api2.mubu.com, api2.openreview.net, apiv1.oschina.net, app.cj.sina.com.cn, app.slock.ai, appxxxx.h5.xet.citv.cn, archive.org, arxiv.org, assets.grok.com, auth.1point3acres.com, auth.band.us, auth.openai.com, azuresearch-usnc.nuget.org, baijiahao.baidu.com, bbs.hupu.com, bid.powerchina.cn, bizapi.csdn.net

Source & flagged code

11 flagged

package.jsonView file

Lines 37-77json

37 "docs/guide/",

38 "skills/opencli-*/**",

39 "cli-manifest.json",

40 "scripts/",

41 "README.md",

42 "LICENSE"

43 ],

44 "scripts": {

45 "dev": "tsx src/main.ts",

46 "dev:bun": "bun src/main.ts",

47 "release": "npm version prerelease --preid pp -m \"[pp-only] chore(release): %s\" && git push origin HEAD && git push origin \"$(git describe --tags --abbrev=0)\"",

48 "build": "npm run clean-dist && npm run copy-yaml && npm run build-manifest",

49 "minify:release": "bun scripts/minify-release.mjs",

50 "prebuild-manifest": "tsc --build && node -e \"require('fs').chmodSync('dist/src/main.js', 0o755)\"",

51 "build-manifest": "tsx src/build-manifest.ts",

52 "clean-dist": "node scripts/clean-dist.cjs",

53 "copy-yaml": "node scripts/copy-yaml.cjs",

54 "start": "node dist/src/main.js",

55 "start:bun": "bun dist/src/main.js",

56 "preuninstall": "node -e \"fetch('http://127.0.0.1:19825/shutdown',{method:'POST',headers:{'X-OpenCLI':'1'},signal:AbortSignal.timeout(3000)}).catch(()=>{})\" || true",

57 "postinstall": "node scripts/postinstall.js || true; node scripts/fetch-adapters.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "typecheck": "tsc --noEmit",

59 "prepare": "[ -d src ] && npm run build || true",

60 "prepublishOnly": "npm run build",

61 "test": "vitest run --project unit --project extension --project adapter",

62 "test:bun": "bun vitest run --project unit --project extension --project adapter",

63 "test:adapter": "vitest run --project adapter",

64 "test:all": "vitest run",

65 "test:e2e": "vitest run --project e2e-fixed-port --project e2e",

66 "advise:listing-id-pairing": "node scripts/check-listing-id-pairing.mjs",

67 "check:silent-column-drop": "node scripts/check-silent-column-drop.mjs",

68 "check:typed-error-lint": "node scripts/check-typed-error-lint.mjs",

69 "docs:dev": "vitepress dev docs",

70 "docs:build": "vitepress build docs",

71 "docs:preview": "vitepress preview docs"

72 },

73 "keywords": [

74 "cli",

75 "browser",

76 "web",

77 "ai"

dist/src/external.jsView file

Lines 1-1javascript

1import*as Q from"node:fs";import*as Y from"node:path";import*as V from"node:os";import{fileURLToPath as M}from"node:url";import{spawnSync as U,execFileSync as L}from"node:child_process";import $ from"js-yaml";import

dist/src/browser/article-extract.jsView file

Lines 1-2javascript

1import*as j from"node:fs";import{createRequire as O}from"node:module";const v=O(import.meta.url);let Y=null;function U(){if(Y)return Y

dist/src/discovery.jsView file

Lines 1-2javascript

clis/flomo/memos.jsView file

Lines 1-13javascript

scripts/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * postinstall script — install shell completion files and print setup instructions.

5 *

6 * Detects the user's default shell and writes the completion script to the

7 * standard completion directory. For zsh and bash, the script prints manual

8 * instructions instead of modifying rc files (~/.zshrc, ~/.bashrc) — this

9 * avoids breaking multi-line shell commands and other fragile rc structures.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/postinstall.jsView on unpkg · L7

dist/src/browser/managed-chrome.jsView file

Lines 1-1javascript

1import{execFileSync as R}from"node:child_process";import*as B from"node:fs";import*as W from"node:path";import{request as x}from"node:http";import{WebSocket as T}from"ws";import{probeCDP as q,launchDetachedApp as v}

dist/src/launcher.jsView file

1import{execFileSync as G,spawn as w}from"node:child_process";import{request as D}from"node:http";import*as K from"node:path";import{getElectronApp as U}from"./electron-apps.js";imp... L2: ${j(X,J)} L3: `+` • Set OPENCLI_CDP_ENDPOINT=http://127.0.0.1:${J} L4: `+` • Or just re-run the command once ${X} is listening on port ${J}.`);if(detectProcess(W)){H.debug(`[launcher] ${X} is running but CDP not available`);if(!await q(`${X} is runni... L5: `);await killProcess(W)}const B=discoverAppPath(X);if(!B)throw new $(`Could not find ${X} on this machine.`,`Install ${X} or register a custom path in ~/.opencli/apps.yaml`);const ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/launcher.jsView on unpkg · L1

clis/segmentfault/article.jsView file

1import{CliError as O,CommandExecutionError as v}from"@jackwener/opencli/errors";import{cli as y,Strategy as C}from"@jackwener/opencli/registry";import{publishArticle as p}from"../_... L2: </script>`,U);if(T!==-1)try{const V=JSON.parse(G.substring(U+_.length,T));Z=V&&V.global&&V.global.sessionInfo&&V.global.sessionInfo.key}catch(V){}}}if(!Z)throw Error("获取思否 session ... L3: </script>`,z);if(J!==-1)try{const K=JSON.parse(Z.substring(z+Q.length,J));M=K&&K.global&&K.global.sessionInfo&&K.global.sessionInfo.key}catch(K){}}}if(!M)return{ok:!1,stage:"token"...

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

clis/segmentfault/article.jsView on unpkg · L1

scripts/check-doc-coverage.shView file

•path = scripts/check-doc-coverage.sh kind = build_helper sizeBytes = 2256 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-doc-coverage.shView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true; node scripts/fetch-adapters.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true; node scripts/fetch-adapters.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/external.jsView file

1import*as Q from"node:fs";import*as Y from"node:path";import*as V from"node:os";import{fileURLToPath as M}from"node:url";import{spawnSync as U,execFileSync as L}from"node:child_pro...

High

Child Process

Package source references child process execution.

dist/src/external.jsView on unpkg · L1

dist/src/browser/article-extract.jsView file

1import*as j from"node:fs";import{createRequire as O}from"node:module";const v=O(import.meta.url);let Y=null;function U(){if(Y)return Y;const Q=v.resolve("@mozilla/readability/Reada... L2: `)}export async function extractArticle(Q,V={}){const Z=buildExtractArticleJs(V),W=await Q.evaluate(Z);if(W==null||typeof W!=="object")return null;const z=W;if(typeof z.html!=="str...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/browser/article-extract.jsView on unpkg · L1

dist/src/discovery.jsView file

1import*as H from"node:fs";import*as G from"node:os";import*as Y from"node:path";import{fileURLToPath as F,pathToFileURL as v}from"node:url";import{Strategy as A,registerCommand as ... L2: `;try{if(await H.promises.readFile(x,"utf-8")!==B)await H.promises.writeFile(x,B,"utf-8")}catch{await H.promises.writeFile(x,B,"utf-8")}const V=L,q=Y.join(z,"node_modules","@jackwe...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/discovery.jsView on unpkg · L1

clis/flomo/memos.jsView file

1import{cli as y,Strategy as A}from"@jackwener/opencli/registry";import{ArgumentError as m,AuthRequiredError as l,CommandExecutionError as s,EmptyResultError as b}from"@jackwener/op... L2: (() => { ... L5: if (!raw) return null; L6: const me = JSON.parse(raw); L7: const token = me?.access_token || me?.data?.access_token || ''; ... L12: })() L13: `}function P(t){return/auth|unauth|login|token|permission|forbidden|unauthorized|登录|登陆|鉴权|权限/i.test(String(t||""))}function $(t){if(!Array.isArray(t))return"";return t.map((e)=>{if...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

clis/flomo/memos.jsView on unpkg · L1

scripts/postinstall.jsView file

7* standard completion directory. For zsh and bash, the script prints manual L8: * instructions instead of modifying rc files (~/.zshrc, ~/.bashrc) — this L9: * avoids breaking multi-line shell commands and other fragile rc structures. ... L60: function detectShell() { L61: const shell = process.env.SHELL || ''; L62: if (shell.includes('zsh')) return 'zsh'; ... L77: // Skip in CI environments L78: if (process.env.CI || process.env.CONTINUOUS_INTEGRATION) { L79: return; ... L93: L94: const home = homedir(); L95:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/postinstall.jsView on unpkg · L7

dist/src/browser/managed-chrome.jsView file

1import{execFileSync as R}from"node:child_process";import*as B from"node:fs";import*as W from"node:path";import{request as x}from"node:http";import{WebSocket as T}from"ws";import{pr...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/browser/managed-chrome.jsView on unpkg · L1

dist/src/launcher.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/launcher.jsView on unpkg · L1

clis/segmentfault/article.jsView file

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

clis/segmentfault/article.jsView on unpkg · L1

scripts/check-doc-coverage.shView file

•path = scripts/check-doc-coverage.sh kind = build_helper sizeBytes = 2256 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-doc-coverage.shView on unpkg

Findings

1 Critical4 High7 Medium10 Low

CriticalBuiltin Api Tampering Exfiltrationclis/segmentfault/article.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/src/external.js

HighSame File Env Network Executiondist/src/browser/managed-chrome.js

HighCommand Output Exfiltrationdist/src/launcher.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/src/discovery.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/postinstall.js

MediumShips Build Helperscripts/check-doc-coverage.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/src/browser/article-extract.js

LowWeak Cryptoclis/flomo/memos.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

11 flagged

package.jsonView file

Lines 37-77json

37 "docs/guide/",

38 "skills/opencli-*/**",

39 "cli-manifest.json",

40 "scripts/",

41 "README.md",

42 "LICENSE"

43 ],

44 "scripts": {

45 "dev": "tsx src/main.ts",

46 "dev:bun": "bun src/main.ts",

47 "release": "npm version prerelease --preid pp -m \"[pp-only] chore(release): %s\" && git push origin HEAD && git push origin \"$(git describe --tags --abbrev=0)\"",

48 "build": "npm run clean-dist && npm run copy-yaml && npm run build-manifest",

49 "minify:release": "bun scripts/minify-release.mjs",

50 "prebuild-manifest": "tsc --build && node -e \"require('fs').chmodSync('dist/src/main.js', 0o755)\"",

51 "build-manifest": "tsx src/build-manifest.ts",

52 "clean-dist": "node scripts/clean-dist.cjs",

53 "copy-yaml": "node scripts/copy-yaml.cjs",

54 "start": "node dist/src/main.js",

55 "start:bun": "bun dist/src/main.js",

56 "preuninstall": "node -e \"fetch('http://127.0.0.1:19825/shutdown',{method:'POST',headers:{'X-OpenCLI':'1'},signal:AbortSignal.timeout(3000)}).catch(()=>{})\" || true",

57 "postinstall": "node scripts/postinstall.js || true; node scripts/fetch-adapters.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 "typecheck": "tsc --noEmit",

59 "prepare": "[ -d src ] && npm run build || true",

60 "prepublishOnly": "npm run build",

61 "test": "vitest run --project unit --project extension --project adapter",

62 "test:bun": "bun vitest run --project unit --project extension --project adapter",

63 "test:adapter": "vitest run --project adapter",

64 "test:all": "vitest run",

65 "test:e2e": "vitest run --project e2e-fixed-port --project e2e",

66 "advise:listing-id-pairing": "node scripts/check-listing-id-pairing.mjs",

67 "check:silent-column-drop": "node scripts/check-silent-column-drop.mjs",

68 "check:typed-error-lint": "node scripts/check-typed-error-lint.mjs",

69 "docs:dev": "vitepress dev docs",

70 "docs:build": "vitepress build docs",

71 "docs:preview": "vitepress preview docs"

72 },

73 "keywords": [

74 "cli",

75 "browser",

76 "web",

77 "ai"

dist/src/external.jsView file

Lines 1-1javascript

dist/src/browser/article-extract.jsView file

Lines 1-2javascript

1import*as j from"node:fs";import{createRequire as O}from"node:module";const v=O(import.meta.url);let Y=null;function U(){if(Y)return Y

dist/src/discovery.jsView file

Lines 1-2javascript

clis/flomo/memos.jsView file

Lines 1-13javascript

scripts/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * postinstall script — install shell completion files and print setup instructions.

5 *

6 * Detects the user's default shell and writes the completion script to the

7 * standard completion directory. For zsh and bash, the script prints manual

8 * instructions instead of modifying rc files (~/.zshrc, ~/.bashrc) — this

9 * avoids breaking multi-line shell commands and other fragile rc structures.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/postinstall.jsView on unpkg · L7

dist/src/browser/managed-chrome.jsView file

Lines 1-1javascript

dist/src/launcher.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/launcher.jsView on unpkg · L1

clis/segmentfault/article.jsView file

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

clis/segmentfault/article.jsView on unpkg · L1

scripts/check-doc-coverage.shView file

•path = scripts/check-doc-coverage.sh kind = build_helper sizeBytes = 2256 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-doc-coverage.shView on unpkg