registry / u1s1-cli / 1.14.1

u1s1-cli@1.14.1

u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Source inspection found that the postinstall hook applies text patches to Pi dependencies. The login flow sends generated device material to the configured API origin and waits for approval; no credential redirection or malicious install behavior was established.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installation runs the postinstall patch script; device login runs when invoked or when the CLI finds no valid device credential.

Impact

No concrete malicious effect was established in the inspected paths.

Mechanism

The login start request sends a generated public key and device metadata, then polls for browser approval. The signing proxy uses the configured API origin.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall hook runs a patch script that changes dependency files only when its text patches apply.
Device login sends a generated public key and device metadata to the configured API origin; the caller starts that flow and polls for approval.
The authentication helper returns an existing valid device credential or starts login when one is absent.
The login origin comes from the configured API base URL, and the signing proxy derives its upstream from that same configuration.
Agent setup stores a reference to the CLI API key environment variable; the CLI installs a child-process environment guard.
The CLI uses a local signing proxy for its configured provider.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

8 flagged

package.jsonView file

Lines 10-50json

10 "./embed": {

11 "types": "./dist/embed.d.ts",

12 "default": "./dist/embed.js"

13 },

14 "./package.json": "./package.json"

15 },

16 "files": [

17 "dist",

18 "bench",

19 "scripts"

20 ],

21 "engines": {

22 "node": ">=22.19.0"

23 },

24 "scripts": {

25 "build": "tsc",

26 "dev": "tsx src/index.ts",

27 "typecheck": "tsc --noEmit",

28 "prepublishOnly": "npm run build && npm test",

29 "test": "U1S1_LANG=zh tsx --test test/*.test.ts && U1S1_LANG=zh node scripts/render-regression.mjs",

30 "postinstall": "node scripts/patch-pi.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

31 "package": "bash ../../scripts/package.sh",

32 "upload-release": "bash ../../scripts/upload-release.sh",

33 "release": "npm run package && npm run upload-release"

34 },

35 "keywords": [

36 "ai",

37 "cli",

38 "coding-agent",

39 "deepseek",

40 "u1s1"

41 ],

42 "license": "MIT",

43 "homepage": "https://u1s1app.com",

44 "dependencies": {

45 "@earendil-works/pi-coding-agent": "1.2.0",

46 "@earendil-works/pi-tui": "1.2.0",

47 "typebox": "1.3.7"

48 },

49 "devDependencies": {

50 "@types/node": "^22.20.1",

scripts/render-regression.mjsView file

Lines 121-161javascript

121terminal.writes = [];

122fullWidthComponent.lines = fullWidthComponent.lines.slice(0, 2);

123tui.renderNow();

124const deletionFrame = terminal.writes.join(

dist/update.jsView file

Lines 1-31javascript

1import { execFileSync, spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";

4import { createRequire } from "node:module";

scripts/patch-pi.jsView file

Lines 4-44javascript

4 * The repository applies patches/*.patch through pnpm for development, while

5 * global `npm i -g u1s1-cli` installations do not understand pnpm patches.

6 * This script applies the same Windows TUI and UI-text (zh/en by

7 * U1S1_LANG) fixes to installed dependencies so both installation paths behave identically.

8 *

9 * Properties:

10 * - Pure Node implementation with no patch(1) dependency, including Windows

11 * - Idempotent across pnpm-patched and previously patched installations

12 * - Never fails installation; mismatches only emit a notice and exit 0

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { writeFileSync } from "node:fs"; writeFileSync(tty, "\x1b[>4;2m"); const officialCfg = { ...cfg, baseUrl: signing.baseUrl, apiKey: signing.localKey }; process.env["U1S1_SIGNING_PROXY_URL"] = officialCfg.baseUrl; baseUrl: officialCfg.baseUrl, console.log(` Server ${cfg.baseUrl}`); console.log(` 服务器 ${cfg.baseUrl}`); const resp = await authorizedFetch(current, `${current.baseUrl}/device`, { method: "DELETE" }).catch(() => null);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

dist/agent-setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent-setup.js#virtual:normalized:round1View on unpkg

dist/secret-env.jsView file

•matchType = normalized_sha256 matchedPackage = u1s1-cli@1.8.1 matchedPath = dist/secret-env.js matchedIdentity = npm:dTFzMS1jbGk:1.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/secret-env.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-pi.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/render-regression.mjsView file

141function renderHotkeys() { L142: const fn = new Function(...keyVars, `${hotkeysSrc}\nreturn [${titleExpr ?? '"Keyboard Shortcuts"'}, hotkeys, ${extHeader}].join("\\n");`); L143: return fn(...keyVars.map((v) => `<${v}>`));

Low

Eval

Package source references a known benign dynamic code generation pattern.

scripts/render-regression.mjsView on unpkg · L141

dist/update.jsView file

11import { readJsonResponseCapped, readResponseTextCapped } from "./api.js"; L12: const require = createRequire(import.meta.url); L13: const pkg = require("../package.json");

Findings

6 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencescripts/patch-pi.js

HighCredential Redirect Persistencedist/index.js

HighSemantic Analysis Limiteddist/agent-setup.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/secret-env.js

HighPrevious Version Dangerous Deltascripts/patch-pi.js

MediumDynamic Requiredist/update.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalscripts/render-regression.mjs

Low

Affected versions and remediation

This report applies to u1s1-cli@1.14.1.

See all versions of u1s1-cli for other recorded verdicts.

Review the evidence and your use of u1s1-cli@1.14.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 18:45:28.179Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.