u1s1-cli@1.11.1
u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe package installs first-party agent extensions when the CLI starts, which warrants a warning under the agent extension setup policy. The inspected sources do not substantiate the scanner’s unofficial-gateway credential redirection claim or a concrete attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user starts the u1s1 CLI.
Impact
The agent gains u1s1-provided tools; the inspected code does not establish an attack.
Mechanism
Startup registers web tools and writes a package-owned tools extension that uses the credential guard.
AI rationale
The package installs first-party agent extensions when the CLI starts, which warrants a warning under the agent extension setup policy. The inspected sources do not substantiate the scanner’s unofficial-gateway credential redirection claim or a concrete attack.
Evidence
dist/index.jsdist/agent-setup.js
Network endpoints1
api.u1s1.io/v1
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI startup registers package-owned agent extensions in the agent extensions directory.
- The generated tools extension uses the credential guard to keep API keys out of child processes.
- The default API host is api.u1s1.io, and model requests use the configured base URL.
- The postinstall hook runs a local patch script; no unrelated approval or agent-control mutation was identified.
Evidence against
- The inspected credential flow uses the package’s official API host, not the flagged unofficial gateway.
- The child-process guard strips credential environment variables from spawned processes.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/patch-pi.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/shell-doctor.jsView file
1import { spawn } from "node:child_process";
L2: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/shell-doctor.jsView on unpkg · L1142console.error(" ⚠ 未找到 Git Bash,将使用 WSL 的 bash:命令会在 WSL 的 Linux 里执行,不是 Windows 本机。");
L143: console.error(" 建议安装 Git for Windows(PowerShell 运行: winget install --id Git.Git)后重启 u1s1。");
L144: }
High
Findings
12 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/shell-doctor.js
HighShelldist/shell-doctor.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighSandbox Evasion Gated Capabilitydist/update.js
HighSemantic Analysis Limiteddist/agent-setup.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/update.js
HighKnown Malware Source Similaritydist/search-tools.js
HighKnown Malware Source Similaritydist/secret-env.js
HighKnown Malware Source Similaritydist/error-humanize.js
High
Affected versions and remediation
This report applies to u1s1-cli@1.11.1.
See all versions of u1s1-cli for other recorded verdicts.
- Review the evidence and your use of u1s1-cli@1.11.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.