Loading npm security reports…

tuniu-cli@1.1.4: AI-agent control-surface risk | LPM Firewall

registry / tuniu-cli / 1.1.4

tuniu-cli@1.1.4

Tuniu MCP CLI tool for calling enterprise MCP services

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package triggers a postinstall script that writes a package-controlled AI skill into multiple unrelated agent control surfaces. It also falls back to a generic agent skill directory.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, including automatic postinstall execution

Impact

The package can alter the instructions and available capabilities of installed AI-agent environments without an explicit user command.

Mechanism

automatic cross-agent skill deployment

Policy narrative

During npm installation, package.json runs scripts/postinstall.js. That script detects several third-party AI-agent home directories and copies its bundled SKILL.md and references into each matching directory. It removes the prior references directory and, when none match, creates a generic ~/.agents/skills/tuniu-cli installation. This is an unconsented postinstall mutation of broad AI-agent control surfaces.

AI rationale

The automatic lifecycle hook installs package-authored instructions into multiple foreign AI-agent directories and has a generic fallback. This meets the install-time AI-agent control-surface abuse policy even though the hook itself does not make network requests.

Evidence

package.jsonscripts/postinstall.jsskill/SKILL.mdskill/references~/.claude/skills/tuniu-cli~/.cursor/skills/tuniu-cli~/.codex/skills/tuniu-cli~/.config/opencode/skills/tuniu-cli~/.agents/skills/tuniu-cli

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: constructor(message = "\u8BA4\u8BC1\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5 API Key", server) { var AUTH_PROMPT_AUTO = "\u8BF7\u6267\u884C tuniu auth login\uFF1B\u5982\u679C\u5F53\u524D\u7EC8\u7AEF\u65E0\u6CD5\u6253\u5F00\u6D4F\u89C8\u5668\uFF0C\u53EF\u914D\u7F6E TUNIU_API_KE... var AUTH_PROMPT_API_KEY = "\u5F53\u524D\u670D\u52A1\u9700\u8981 API Key \u8BA4\u8BC1\uFF0C\u8BF7\u524D\u5F80\u9014\u725B\u5F00\u653E\u5E73\u53F0\u83B7\u53D6 API Key\uFF0C\u540E\u91... var AUTH_PROMPT_TTMS_API_KEY = "\u5F53\u524D\u5546\u65C5\u670D\u52A1\u9700\u8981 API Key \u8BA4\u8BC1\uFF0C\u8BF7\u524D\u5F80\u9014\u725B\u5F00\u653E\u5E73\u53F0\u83B7\

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

13Trigger-reachable persistence chain: manifest.main -> dist/index.js L13: var McpCliError = class extends Error { L14: exitCode = 199 /* UNKNOWN_ERROR */; L15: errorType = "UnknownError"; ... L226: } L227: const env = process.env.TUNIU_AUTH_SOURCE; L228: if (env?.trim()) { ... L250: constructor(options = {}) { L251: this.cacheDir = options.cacheDir ?? path.join(os.homedir(), ".tuniu-mcp", "cache"); L252: this.cacheFile = options.cacheFile ?? path.join(this.cacheDir, "discovery.json"); ... L259: const raw = await fsp.readFile(this.cacheFile, "utf-8"); L260: const data = JSON.parse(raw); L261: if (Date.now() > data.expiresAt) {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index.jsView on unpkg · L13

13var McpCliError = class extends Error { L14: exitCode = 199 /* UNKNOWN_ERROR */; L15: errorType = "UnknownError"; ... L226: } L227: const env = process.env.TUNIU_AUTH_SOURCE; L228: if (env?.trim()) { ... L250: constructor(options = {}) { L251: this.cacheDir = options.cacheDir ?? path.join(os.homedir(), ".tuniu-mcp", "cache"); L252: this.cacheFile = options.cacheFile ?? path.join(this.cacheDir, "discovery.json"); ... L259: const raw = await fsp.readFile(this.cacheFile, "utf-8"); L260: const data = JSON.parse(raw); L261: if (Date.now() > data.expiresAt) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L13

scripts/postinstall.jsView file

16const AGENT_DIRS = [ L17: { dir: '.claude/skills', parent: '.claude' }, L18: { dir: '.cursor/skills', parent: '.cursor' }, L19: { dir: '.qoder/skills', parent: '.qoder' }, L20: { dir: '.codex/skills', parent: '.codex' }, L21: { dir: '.config/opencode/skills', parent: '.config/opencode' }, ... L51: function copySkillBundle(sourceDir, destDir) { L52: fs.mkdirSync(destDir, { recursive: true }); L53: fs.copyFileSync(path.join(sourceDir, 'SKILL.md'), path.join(destDir, 'SKILL.md')); L54: ... L61: fs.rmSync(destReferencesDir, { recursive: true, force: true }); L62: fs.cpSync(referencesDir, destReferencesDir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L16