registry / u1s1-cli / 1.2.3

u1s1-cli@1.2.3

⚠ Under review

u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 20 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 301 KB of source, external domains: 127.0.0.1, api.u1s1.io, registry.npmjs.org, u1s1.io, www.w3.org

Source & flagged code

12 flagged

package.jsonView file

Lines 10-50json

10 "./embed": {

11 "types": "./dist/embed.d.ts",

12 "default": "./dist/embed.js"

13 },

14 "./package.json": "./package.json"

15 },

16 "files": [

17 "dist",

18 "bench",

19 "scripts"

20 ],

21 "engines": {

22 "node": ">=22.19.0"

23 },

24 "scripts": {

25 "build": "tsc",

26 "dev": "tsx src/index.ts",

27 "typecheck": "tsc --noEmit",

28 "prepublishOnly": "npm run build && npm test",

29 "test": "tsx --test test/*.test.ts && node scripts/render-regression.mjs",

30 "postinstall": "node scripts/patch-pi.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

31 "package": "bash ../../scripts/package.sh",

32 "upload-release": "bash ../../scripts/upload-release.sh",

33 "release": "npm run package && npm run upload-release"

34 },

35 "keywords": [

36 "ai",

37 "cli",

38 "coding-agent",

39 "deepseek",

40 "u1s1"

41 ],

42 "license": "MIT",

43 "homepage": "https://u1s1.io",

44 "dependencies": {

45 "@earendil-works/pi-coding-agent": "0.84.3",

46 "@earendil-works/pi-tui": "0.84.3",

47 "typebox": "1.3.7"

48 },

49 "devDependencies": {

50 "@types/node": "^22.20.1",

dist/shell-doctor.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/shell-doctor.jsView on unpkg · L1

3import { dirname, join } from "node:path";

4import

dist/workflow/runner.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { execFileSync } from "node:child_process";

3import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/workflow/runner.jsView on unpkg · L1

dist/update.jsView file

Lines 1-27javascript

1import { execSync, spawnSync } from "node:child_process";

2import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";

3import { createRequire } from "node:module";

4import { tmpdir } from "node:os";

dist/index.jsView file

Lines 77-117javascript

77/**

78 * TUI 退出后前台安装新版:此刻不再有模型调用和懒加载,重铺 node_modules 才安全。

79 * 不设 timeout——半路杀掉 npm 会留下残缺的全局安装,之后连启动都起不来;

80 * stdio 直通,装多久用户看得见。(同机另开的 u1s1 实例仍会被重铺波及,属残余

81 * 风险,但远好于更新自己脚下这棵树。)

82 */

83function installPendingUpdate() {

84 if (!pendingUpdate)

Source & flagged code

12 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code