registry / Install hook abuse / u1s1-cli

u1s1-cli

u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。

This report shows the evidence for u1s1-cli@1.8.1. 1 of 53 known versions is blocked or flagged. The newest version, 1.14.3, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic lifecycle hook modifies third-party AI-agent source and searches broadly for targets. This meets the install-hook abuse block policy despite the visible patches appearing UI-focused.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation

Impact

Changes to another AI-agent's behavior persist in the installed dependency tree without an explicit user command.

Mechanism

automatic rewriting of third-party AI-agent dependency source

Attack narrative

The package declares a postinstall hook that runs scripts/patch-pi.js. That script resolves Pi coding-agent dependencies, walks parent directories for hoisted copies, and writes modified source into their distribution files. Although the visible changes are UI-oriented, this is an unconsented install-time mutation of a foreign AI-agent control surface and can affect dependency copies outside the package's own directory.

AI rationale

The automatic lifecycle hook modifies third-party AI-agent source and searches broadly for targets. This meets the install-hook abuse block policy despite the visible patches appearing UI-focused.

Evidence

package.jsonscripts/patch-pi.jsnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/assistant-message.js

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

The install lifecycle automatically runs a dependency-patching script.
That script searches upward for installed Pi agent packages, including hoisted copies.
It rewrites Pi agent interface source during installation without a user command.

Evidence against

The shown replacements are explicit interface and translation changes rather than credential theft or remote payload loading.
Runtime agent data is placed under the package's own .u1s1 directory.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 49 file(s), 481 KB of source, external domains: 127.0.0.1, api.u1s1.io, mcp.exa.ai, registry.npmjs.org, u1s1.io, www.w3.org

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node scripts/patch-pi.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/shell-doctor.jsView file

1import { spawn } from "node:child_process"; L2: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/shell-doctor.jsView on unpkg · L1

142console.error(" ⚠ 未找到 Git Bash,将使用 WSL 的 bash:命令会在 WSL 的 Linux 里执行,不是 Windows 本机。"); L143: console.error(" 建议安装 Git for Windows(PowerShell 运行: winget install --id Git.Git)后重启 u1s1。"); L144: }

High

Shell

Package source references shell execution.

dist/shell-doctor.jsView on unpkg · L142

dist/workflow/runner.jsView file

1import { createHash } from "node:crypto"; L2: import { execFileSync } from "node:child_process"; L3: import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L29: try { L30: const e = JSON.parse(line); L31: if (typeof e.key === "string") ... L82: [/\bglobalThis\b/, "globalThis"], L83: [/\bfetch\s*\(/, "fetch()"], L84: [/\beval\s*\(/, "eval()"], ... L184: projectTrusted: opts.projectTrusted, L185: trustCwd: process.cwd(), L186: noTools: o.noTools === true,

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/workflow/runner.jsView on unpkg · L1

83[/\bfetch\s*\(/, "fetch()"], L84: [/\beval\s*\(/, "eval()"], L85: [/\bFunction\s*\(/, "new Function()"],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/workflow/runner.jsView on unpkg · L83

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/workflow/runner.jsView on unpkg · L1

dist/update.jsView file

1import { execFileSync, spawnSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L10: const require = createRequire(import.meta.url); L11: const pkg = require("../package.json"); L12: export const VERSION = pkg.version; ... L30: // Check common global install locations for clues L31: const userAgent = process.env.npm[redacted] ?? ""; L32: if (userAgent.startsWith("pnpm")) ... L41: export async function getLatestVersion() { L42: const url = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; L43: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/update.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = u1s1-cli@1.5.0 matchedIdentity = npm:dTFzMS1jbGk:1.5.0 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/update.jsView on unpkg

9import { readJsonResponseCapped, readResponseTextCapped } from "./api.js"; L10: const require = createRequire(import.meta.url); L11: const pkg = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/update.jsView on unpkg · L9

dist/index.jsView file

106console.error(process.platform === "win32" L107: ? " powershell -c \"irm https://u1s1.io/releases/install.ps1 | iex\"" L108: : " curl -fsSL https://u1s1.io/releases/install.sh | bash"); ... L121: function ensureTmuxKeyboardProtocol() { L122: if (!process.env.TMUX) L123: return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L106

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { writeFileSync } from "node:fs"; writeFileSync(tty, "\x1b[>4;2m"); const officialCfg = { ...cfg, baseUrl: signing.baseUrl, apiKey: signing.localKey }; process.env["U1S1_SIGNING_PROXY_URL"] = officialCfg.baseUrl; baseUrl: officialCfg.baseUrl, const resp = await authorizedFetch(current, `${current.baseUrl}/device`, { method: "DELETE" }).catch(() => null);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

dist/agent-setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent-setup.js#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-pi.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/shell-doctor.jsView file

1import { spawn } from "node:child_process"; L2: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/shell-doctor.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/shell-doctor.jsView on unpkg · L142

Findings

8 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/shell-doctor.js

HighShelldist/shell-doctor.js

HighSame File Env Network Executiondist/index.js

HighCredential Redirect Persistencedist/index.js

HighSandbox Evasion Gated Capabilitydist/update.js

HighSemantic Analysis Limiteddist/agent-setup.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/update.js

MediumDynamic Requiredist/update.js

MediumUnsafe Vm Contextdist/workflow/runner.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to u1s1-cli@1.8.1.

The versions list below shows the verdict for each recorded version.

Avoid installing u1s1-cli@1.8.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-05 02:18:45.610Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

53 known versions

1.14.3latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 22, 2026, 8:14 AM 1.14.1Clean—AllowPublishedOct 15, 2026, 9:01 AM 1.14.0Clean—AllowPublishedOct 14, 2026, 5:36 PM 1.13.1Clean—AllowPublishedOct 2, 2026, 7:28 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other install hook abuse packages

Behavioral surface

Related packages

Other install hook abuse packages

Source & flagged code