registry / AI-agent control-surface risk / tuniu-cli

tuniu-cli

Tuniu MCP CLI tool for calling enterprise MCP services

This report shows the evidence for tuniu-cli@1.1.4. 6 of 6 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The automatic lifecycle hook installs package-authored instructions into multiple foreign AI-agent directories and has a generic fallback. This meets the install-time AI-agent control-surface abuse policy even though the hook itself does not make network requests.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, including automatic postinstall execution

Impact

The package can alter the instructions and available capabilities of installed AI-agent environments without an explicit user command.

Mechanism

automatic cross-agent skill deployment

Policy narrative

During npm installation, package.json runs scripts/postinstall.js. That script detects several third-party AI-agent home directories and copies its bundled SKILL.md and references into each matching directory. It removes the prior references directory and, when none match, creates a generic ~/.agents/skills/tuniu-cli installation. This is an unconsented postinstall mutation of broad AI-agent control surfaces.

AI rationale

Evidence

package.jsonscripts/postinstall.jsskill/SKILL.mdskill/references~/.claude/skills/tuniu-cli~/.cursor/skills/tuniu-cli~/.codex/skills/tuniu-cli~/.config/opencode/skills/tuniu-cli~/.agents/skills/tuniu-cli

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook automatically runs the installer.
The installer targets nine different AI-agent skill directories under the user's home directory.
It copies the bundled skill and references into those directories, deleting existing bundled references first.
On hosts without a detected agent directory, it still writes to the generic .agents skill directory.

Evidence against

The install hook uses a bundled local skill rather than downloading one.
No credential collection or network request occurs in the postinstall script itself.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 257 KB of source, external domains: open-pre.tuniu.com, open.tuniu.com, openapi-p.tuniu.cn, openapi.tuniu.cn, registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 1-41json

2 "name": "tuniu-cli",

3 "version": "1.1.4",

4 "description": "Tuniu MCP CLI tool for calling enterprise MCP services",

5 "type": "module",

6 "bin": {

7 "tuniu": "bin/tuniu.js"

8 },

9 "main": "dist/index.js",

10 "files": [

11 "dist",

12 "bin",

13 "scripts",

14 "config.example.json",

15 "agent-manifest.json",

16 "README.md",

17 "skill",

18 "LICENSE"

19 ],

20 "scripts": {

21 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepublishOnly": "npm run build",

23 "prepack": "npm run build && npm run generate:skill-hash",

24 "generate:skill-hash": "node scripts/generate-skill-sha.mjs",

25 "check:skill-hash": "node scripts/check-skill-hash.mjs",

26 "mock:discovery": "node dev/mock/discovery.server.mjs",

27 "build": "tsup",

28 "dev": "node --import tsx src/index.ts",

29 "pre": "node bin/tuniu.js",

30 "prd": "node bin/tuniu.js",

31 "test": "vitest run",

32 "test:watch": "vitest",

33 "lint": "eslint src/ tests/",

34 "lint:fix": "eslint src/ tests/ --fix",

35 "typecheck": "tsc --noEmit"

36 },

37 "keywords": [

38 "mcp",

39 "cli",

40 "tuniu"

41 ],

dist/index.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// src/cli.ts

4import { Command } from "commander";

6// src/config/settings.ts

7import fs2 from "fs";

8import os3 from

scripts/postinstall.jsView file

Lines 1-36javascript

1/**

2 * npm postinstall script for tuniu-cli

3 * Automatically installs SKILL.md to detected Agent directories

4 */

6import crypto from 'node:crypto';

7import fs from 'node:fs';

8import os

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: constructor(message = "\u8BA4\u8BC1\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5 API Key", server) { var AUTH_PROMPT_AUTO = "\u8BF7\u6267\u884C tuniu auth login\uFF1B\u5982\u679C\u5F53\u524D\u7EC8\u7AEF\u65E0\u6CD5\u6253\u5F00\u6D4F\u89C8\u5668\uFF0C\u53EF\u914D\u7F6E TUNIU_API_KE... var AUTH_PROMPT_API_KEY = "\u5F53\u524D\u670D\u52A1\u9700\u8981 API Key \u8BA4\u8BC1\uFF0C\u8BF7\u524D\u5F80\u9014\u725B\u5F00\u653E\u5E73\u53F0\u83B7\u53D6 API Key\uFF0C\u540E\u91... var AUTH_PROMPT_TTMS_API_KEY = "\u5F53\u524D\u5546\u65C5\u670D\u52A1\u9700\u8981 API Key \u8BA4\u8BC1\uFF0C\u8BF7\u524D\u5F80\u9014\u725B\u5F00\u653E\u5E73\u53F0\u83B7\

Findings

1 Critical3 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/index.js

HighTrigger Reachable Persistencedist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to tuniu-cli@1.1.4.

The versions list below shows the verdict for each recorded version.

Avoid installing tuniu-cli@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-13 00:32:21.427Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

6 known versions

1.1.4latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 9, 2026, 6:50 AM 1.1.2MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 4, 2026, 7:26 AM 1.1.1MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 31, 2026, 12:49 PM 1.1.0MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 28, 2026, 6:55 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code