u1s1-cli@1.9.0

u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No concrete credential theft, destructive action, remote payload execution, or foreign broad agent-control-surface mutation was found. The package nevertheless automatically establishes a package-owned agent extension surface and downloads executables at runtime, so it should be warned rather than published as clean.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall runs the patch; invoking the u1s1 CLI creates extensions and may download missing tools.

Impact

Adds code to the package-owned agent profile and installs network-delivered executables; no secret theft or foreign agent-profile mutation was confirmed.

Mechanism

package-owned agent extension setup, dependency patching, and runtime binary download

AI rationale

Evidence

package.jsonscripts/patch-pi.jsdist/config.jsdist/agent-setup.jsdist/search-tools.js~/.u1s1/agent/extensionsnode_modules/@earendil-works/pi-coding-agentnode_modules/@earendil-works/pi-tui

Network endpoints1

api.u1s1.io

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The postinstall hook locates and rewrites files in installed pi dependencies.
Running the CLI creates and loads extensions in a package-owned AI-agent directory.
At runtime it downloads and installs executable search utilities when they are absent.

Evidence against

The agent directory is isolated under .u1s1 rather than a shared Codex or pi configuration path.
The inspected postinstall code contains fixed UI and translation replacements and makes no network request.
Credential-related environment variables are stripped before child processes are launched.
No credential harvesting or unconsented data exfiltration was found in the inspected paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

19 flagged

package.jsonView file

•scripts.postinstall = node scripts/patch-pi.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/shell-doctor.jsView file

1import { spawn } from "node:child_process"; L2: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/shell-doctor.jsView on unpkg · L1

142console.error(" ⚠ 未找到 Git Bash,将使用 WSL 的 bash:命令会在 WSL 的 Linux 里执行,不是 Windows 本机。"); L143: console.error(" 建议安装 Git for Windows(PowerShell 运行: winget install --id Git.Git)后重启 u1s1。"); L144: }

High

Shell

Package source references shell execution.

dist/shell-doctor.jsView on unpkg · L142

•matchType = normalized_sha256 matchedPackage = u1s1-cli@1.8.1 matchedPath = dist/shell-doctor.js matchedIdentity = npm:dTFzMS1jbGk:1.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/shell-doctor.jsView on unpkg

dist/workflow/runner.jsView file

•matchType = normalized_sha256 matchedPackage = u1s1-cli@1.8.1 matchedPath = dist/workflow/runner.js matchedIdentity = npm:dTFzMS1jbGk:1.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/workflow/runner.jsView on unpkg

1import { createHash } from "node:crypto"; L2: import { execFileSync } from "node:child_process"; L3: import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L29: try { L30: const e = JSON.parse(line); L31: if (typeof e.key === "string") ... L82: [/\bglobalThis\b/, "globalThis"], L83: [/\bfetch\s*\(/, "fetch()"], L84: [/\beval\s*\(/, "eval()"], ... L184: projectTrusted: opts.projectTrusted, L185: trustCwd: process.cwd(), L186: noTools: o.noTools === true,

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/workflow/runner.jsView on unpkg · L1

83[/\bfetch\s*\(/, "fetch()"], L84: [/\beval\s*\(/, "eval()"], L85: [/\bFunction\s*\(/, "new Function()"],

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/workflow/runner.jsView on unpkg · L83

dist/update.jsView file

1import { execFileSync, spawnSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L10: const require = createRequire(import.meta.url); L11: const pkg = require("../package.json"); L12: export const VERSION = pkg.version; ... L30: // Check common global install locations for clues L31: const userAgent = process.env.npm[redacted] ?? ""; L32: if (userAgent.startsWith("pnpm")) ... L41: export async function getLatestVersion() { L42: const url = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; L43: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/update.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = u1s1-cli@1.8.1 matchedPath = dist/update.js matchedIdentity = npm:dTFzMS1jbGk:1.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/update.jsView on unpkg

9import { readJsonResponseCapped, readResponseTextCapped } from "./api.js"; L10: const require = createRequire(import.meta.url); L11: const pkg = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/update.jsView on unpkg · L9

dist/index.jsView file

106console.error(process.platform === "win32" L107: ? " powershell -c \"irm https://u1s1.io/releases/install.ps1 | iex\"" L108: : " curl -fsSL https://u1s1.io/releases/install.sh | bash"); ... L121: function ensureTmuxKeyboardProtocol() { L122: if (!process.env.TMUX) L123: return;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L106

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { writeFileSync } from "node:fs"; writeFileSync(tty, "\x1b[>4;2m"); const officialCfg = { ...cfg, baseUrl: signing.baseUrl, apiKey: signing.localKey }; process.env["U1S1_SIGNING_PROXY_URL"] = officialCfg.baseUrl; baseUrl: officialCfg.baseUrl, console.log(` 服务器 ${cfg.baseUrl}`); const resp = await authorizedFetch(current, `${current.baseUrl}/device`, { method: "DELETE" }).catch(() => null);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = u1s1-cli@1.8.0 matchedIdentity = npm:dTFzMS1jbGk:1.8.0 similarity = 0.708 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent-setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agent-setup.js#virtual:normalized:round1View on unpkg

dist/search-tools.jsView file

•matchType = normalized_sha256 matchedPackage = u1s1-cli@1.8.1 matchedPath = dist/search-tools.js matchedIdentity = npm:dTFzMS1jbGk:1.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/search-tools.jsView on unpkg

scripts/patch-pi.jsView file

•matchType = normalized_sha256 matchedPackage = u1s1-cli@1.8.1 matchedPath = scripts/patch-pi.js matchedIdentity = npm:dTFzMS1jbGk:1.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/patch-pi.jsView on unpkg

dist/secret-env.jsView file

•matchType = normalized_sha256 matchedPackage = u1s1-cli@1.8.1 matchedPath = dist/secret-env.js matchedIdentity = npm:dTFzMS1jbGk:1.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/secret-env.jsView on unpkg

dist/error-humanize.jsView file

•matchType = normalized_sha256 matchedPackage = u1s1-cli@1.8.1 matchedPath = dist/error-humanize.js matchedIdentity = npm:dTFzMS1jbGk:1.8.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/error-humanize.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-pi.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/shell-doctor.jsView file

1import { spawn } from "node:child_process"; L2: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/shell-doctor.jsView on unpkg · L1

High

Shell

Package source references shell execution.

dist/shell-doctor.jsView on unpkg · L142

Findings

15 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/shell-doctor.js

HighShelldist/shell-doctor.js

HighSame File Env Network Executiondist/index.js

HighCredential Redirect Persistencedist/index.js

HighSandbox Evasion Gated Capabilitydist/update.js

HighSemantic Analysis Limiteddist/agent-setup.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/update.js

HighKnown Malware Source Similaritydist/shell-doctor.js

HighKnown Malware Source Similaritydist/workflow/runner.js

HighKnown Malware Source Similaritydist/search-tools.js

High

Affected versions and remediation

This report applies to u1s1-cli@1.9.0.

See all versions of u1s1-cli for other recorded verdicts.

Review the evidence and your use of u1s1-cli@1.9.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-06 01:13:03.971Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.