Loading npm security reports…

u1s1-cli: Malicious npm security report (Block) | LPM Firewall

registry / u1s1-cli / 1.8.1

u1s1-cli@1.8.1

u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package runs code that modifies installed Pi coding-agent files. The target search can reach hoisted dependency copies above this package.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation

Impact

Changes to another AI-agent's behavior persist in the installed dependency tree without an explicit user command.

Mechanism

automatic rewriting of third-party AI-agent dependency source

Attack narrative

The package declares a postinstall hook that runs scripts/patch-pi.js. That script resolves Pi coding-agent dependencies, walks parent directories for hoisted copies, and writes modified source into their distribution files. Although the visible changes are UI-oriented, this is an unconsented install-time mutation of a foreign AI-agent control surface and can affect dependency copies outside the package's own directory.

Rationale

The automatic lifecycle hook modifies third-party AI-agent source and searches broadly for targets. This meets the install-hook abuse block policy despite the visible patches appearing UI-focused.

Evidence

package.jsonscripts/patch-pi.jsnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/assistant-message.js

Decision evidence

public snapshot

AI called this at 93.0% confidence with false-positive risk.

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-pi.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/shell-doctor.jsView file

1import { spawn } from "node:child_process"; L2: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/shell-doctor.jsView on unpkg · L1

142console.error(" ⚠ 未找到 Git Bash,将使用 WSL 的 bash:命令会在 WSL 的 Linux 里执行,不是 Windows 本机。"); L143: console.error(" 建议安装 Git for Windows(PowerShell 运行: winget install --id Git.Git)后重启 u1s1。"); L144: }

High

Shell

Package source references shell execution.

dist/shell-doctor.jsView on unpkg · L142

dist/workflow/runner.jsView file

1import { createHash } from "node:crypto"; L2: import { execFileSync } from "node:child_process"; L3: import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L29: try { L30: const e = JSON.parse(line); L31: if (typeof e.key === "string") ... L82: [/\bglobalThis\b/, "globalThis"], L83: [/\bfetch\s*\(/, "fetch()"], L84: [/\beval\s*\(/, "eval()"], ... L184: projectTrusted: opts.projectTrusted, L185: trustCwd: process.cwd(), L186: noTools: o.noTools === true,

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/workflow/runner.jsView on unpkg · L1

83[/\bfetch\s*\(/, "fetch()"], L84: [/\beval\s*\(/, "eval()"], L85: [/\bFunction\s*\(/, "new Function()"],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/workflow/runner.jsView on unpkg · L83

1import { createHash } from "node:crypto"; L2: import { execFileSync } from "node:child_process"; L3: import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L29: try { L30: const e = JSON.parse(line); L31: if (typeof e.key === "string") ... L82: [/\bglobalThis\b/, "globalThis"], L83: [/\bfetch\s*\(/, "fetch()"], L84: [/\beval\s*\(/, "eval()"], ... L184: projectTrusted: opts.projectTrusted, L185: trustCwd: process.cwd(), L186: noTools: o.noTools === true,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/workflow/runner.jsView on unpkg · L1

dist/update.jsView file

1import { execFileSync, spawnSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L10: const require = createRequire(import.meta.url); L11: const pkg = require("../package.json"); L12: export const VERSION = pkg.version; ... L30: // Check common global install locations for clues L31: const userAgent = process.env.npm[redacted] ?? ""; L32: if (userAgent.startsWith("pnpm")) ... L41: export async function getLatestVersion() { L42: const url = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; L43: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/update.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = u1s1-cli@1.5.0 matchedIdentity = npm:dTFzMS1jbGk:1.5.0 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/update.jsView on unpkg

9import { readJsonResponseCapped, readResponseTextCapped } from "./api.js"; L10: const require = createRequire(import.meta.url); L11: const pkg = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/update.jsView on unpkg · L9

dist/index.jsView file

106console.error(process.platform === "win32" L107: ? " powershell -c \"irm https://u1s1.io/releases/install.ps1 | iex\"" L108: : " curl -fsSL https://u1s1.io/releases/install.sh | bash"); ... L121: function ensureTmuxKeyboardProtocol() { L122: if (!process.env.TMUX) L123: return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L106

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { writeFileSync } from "node:fs"; writeFileSync(tty, "\x1b[>4;2m"); const officialCfg = { ...cfg, baseUrl: signing.baseUrl, apiKey: signing.localKey }; process.env["U1S1_SIGNING_PROXY_URL"] = officialCfg.baseUrl; baseUrl: officialCfg.baseUrl, const resp = await authorizedFetch(current, `${current.baseUrl}/device`, { method: "DELETE" }).catch(() => null);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

dist/agent-setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent-setup.js#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 10-50json

10 "./embed": {

11 "types": "./dist/embed.d.ts",

12 "default": "./dist/embed.js"

13 },

14 "./package.json": "./package.json"

15 },

16 "files": [

17 "dist",

18 "bench",

19 "scripts"

20 ],

21 "engines": {

22 "node": ">=22.19.0"

23 },

24 "scripts": {

25 "build": "tsc",

26 "dev": "tsx src/index.ts",

27 "typecheck": "tsc --noEmit",

28 "prepublishOnly": "npm run build && npm test",

29 "test": "tsx --test test/*.test.ts && node scripts/render-regression.mjs",

30 "postinstall": "node scripts/patch-pi.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

31 "package": "bash ../../scripts/package.sh",

32 "upload-release": "bash ../../scripts/upload-release.sh",

33 "release": "npm run package && npm run upload-release"

34 },

35 "keywords": [

36 "ai",

37 "cli",

38 "coding-agent",

39 "deepseek",

40 "u1s1"

41 ],

42 "license": "MIT",

43 "homepage": "https://u1s1.io",

44 "dependencies": {

45 "@earendil-works/pi-coding-agent": "0.84.4",

46 "@earendil-works/pi-tui": "0.84.4",

47 "typebox": "1.3.7"

48 },

49 "devDependencies": {

50 "@types/node": "^22.20.1",

dist/shell-doctor.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/shell-doctor.jsView on unpkg · L1

3import { join, win32 } from "node:path";

4import

dist/workflow/runner.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { execFileSync } from "node:child_process";

3import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/workflow/runner.jsView on unpkg · L1

dist/update.jsView file

Lines 1-29javascript

1import { execFileSync, spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";

4import { createRequire } from "node:module";

dist/index.jsView file

Lines 86-126javascript

86 * TUI 退出后前台安装新版:此刻不再有模型调用和懒加载,重铺 node_modules 才安全。

87 * 不设 timeout——半路杀掉 npm 会留下残缺的全局安装,之后连启动都起不来;

88 * stdio 直通,装多久用户看得见。(同机另开的 u1s1 实例仍会被重铺波及,属残余

89 * 风险,但远好于更新自己脚下这棵树。)

90 */

91function installPendingUpdate

dist/agent-setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent-setup.js#virtual:normalized:round1View on unpkg