u1s1-cli@1.14.3
u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。
AI Security Review
scanned 21h ago · by lpm-firewall-aiThe package automatically writes package-owned extensions into the shared agent configuration, a lifecycle integration risk that warrants a warning. The inspected login flow uses the configured service and browser approval, and the postinstall script applies Pi text patches; neither establishes a concrete attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting the CLI agent runtime.
Impact
The extensions can add tools and event handlers to agent sessions, including sessions started through other Pi front ends sharing that directory.
Mechanism
The CLI creates and rewrites extension files in the agent extensions directory; Pi scans that directory for extensions.
AI rationale
The package automatically writes package-owned extensions into the shared agent configuration, a lifecycle integration risk that warrants a warning. The inspected login flow uses the configured service and browser approval, and the postinstall script applies Pi text patches; neither establishes a concrete attack.
Evidence
dist/index.jsdist/agent-setup.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On agent startup, the CLI writes its web tools extension into the shared agent extensions directory.
- The generated extension is loaded by Pi and can register tools for agent sessions.
- The package also runs a postinstall script that patches Pi dependency files.
Evidence against
- The extension is part of u1s1’s documented runtime integration and keeps its API key in an environment variable rather than the generated file.
- Login uses the configured service origin and polls for credentials after browser approval; inspected code did not show a separate credential recipient.
- The postinstall patch applies text changes to Pi dependency files.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/patch-pi.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/render-regression.mjsView file
141function renderHotkeys() {
L142: const fn = new Function(...keyVars, `${hotkeysSrc}\nreturn [${titleExpr ?? '"Keyboard Shortcuts"'}, hotkeys, ${extHeader}].join("\\n");`);
L143: return fn(...keyVars.map((v) => `<${v}>`));
Low
Eval
Package source references a known benign dynamic code generation pattern.
scripts/render-regression.mjsView on unpkg · L141dist/update.jsView file
11import { readJsonResponseCapped, readResponseTextCapped } from "./api.js";
L12: const require = createRequire(import.meta.url);
L13: const pkg = require("../package.json");
Findings
6 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/patch-pi.js
HighCredential Redirect Persistencedist/index.js
HighSemantic Analysis Limiteddist/agent-setup.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/secret-env.js
HighPrevious Version Dangerous Deltadist/index.js
MediumDynamic Requiredist/update.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalscripts/render-regression.mjs
Low
Affected versions and remediation
This report applies to u1s1-cli@1.14.3.
See all versions of u1s1-cli for other recorded verdicts.
- Review the evidence and your use of u1s1-cli@1.14.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.