u1s1-cli@1.11.0
u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package does not meet the combined lifecycle self-dependency or concrete malicious-behavior threshold. Its postinstall mutation of potentially hoisted AI-agent dependency files is nevertheless an unresolved, non-consensual lifecycle risk.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation triggers postinstall; running the u1s1 CLI triggers agent setup.
Impact
The install changes an AI-agent dependency without an explicit command, and the runtime configuration can alter agent presentation and capabilities.
Mechanism
Automatic dependency patching and first-party agent extension setup.
AI rationale
The package does not meet the combined lifecycle self-dependency or concrete malicious-behavior threshold. Its postinstall mutation of potentially hoisted AI-agent dependency files is nevertheless an unresolved, non-consensual lifecycle risk.
Evidence
package.jsonscripts/patch-pi.jsdist/index.jsnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.jsnode_modules/@earendil-works/pi-coding-agent/dist/core/slash-commands.js~/.u1s1/agent/APPEND_SYSTEM.md~/.u1s1/agent/extensions/
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Unknown with low false-positive risk.
Evidence for warning
- The automatic postinstall hook runs a script that patches another package's installed code.
- The patch locator walks upward through parent directories, so it can modify hoisted copies outside this package's own directory.
- The hook overwrites Pi coding-agent UI and extension-handling files, including suppressing extension stack output unless an environment flag is set.
- Normal CLI startup writes and loads several extensions and a system-prompt append file in its agent directory.
Evidence against
- There is no runtime dependency on u1s1-cli itself.
- The reviewed network and binary-download behavior is invoked during CLI use and is aligned with its agent/search features.
- The code explicitly strips its own secret environment variables before child processes are launched.
- No source evidence shows credential exfiltration, destructive commands, or an opaque remote payload in the install hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/patch-pi.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/shell-doctor.jsView file
1import { spawn } from "node:child_process";
L2: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/shell-doctor.jsView on unpkg · L1142console.error(" ⚠ 未找到 Git Bash,将使用 WSL 的 bash:命令会在 WSL 的 Linux 里执行,不是 Windows 本机。");
L143: console.error(" 建议安装 Git for Windows(PowerShell 运行: winget install --id Git.Git)后重启 u1s1。");
L144: }
High
Findings
13 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/shell-doctor.js
HighShelldist/shell-doctor.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighSandbox Evasion Gated Capabilitydist/update.js
HighSemantic Analysis Limiteddist/agent-setup.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/update.js
HighKnown Malware Source Similaritydist/search-tools.js
HighKnown Malware Source Similarityscripts/patch-pi.js
HighKnown Malware Source Similaritydist/secret-env.js
High
Affected versions and remediation
This report applies to u1s1-cli@1.11.0.
See all versions of u1s1-cli for other recorded verdicts.
- Review the evidence and your use of u1s1-cli@1.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.