Loading npm security reports…

uniner-cli-rpa@1.0.2: AI-agent control-surface risk | LPM Firewall

registry / uniner-cli-rpa / 1.0.2

uniner-cli-rpa@1.0.2

uniner-cli-rpa — RPA automation CLI with cloud flow publish: browser automation (Playwright/CDP), Excel, OCR, desktop/SAP, crypto/HTTP/email tools. Includes uniner-cloud-flow skill for publishing flows to Uniner Cloud.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation fetches a remotely selected archive and writes its skill content into Claude Code's global skills directory. The downloaded content controls additional skill names and bodies.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation triggers postinstall automatically.

Impact

A remote archive publisher can replace or add behavior-bearing Claude Code skills without an explicit user command.

Mechanism

Remote archive staging followed by global AI-agent skill installation.

Policy narrative

On installation, the lifecycle hook obtains both a portable archive URL and its checksum from remote metadata, downloads and extracts that archive, then reads skill files from it. It writes those files into the user's global Claude Code skills directory using names supplied by the downloaded content. This creates an unauthenticated remote channel into an AI-agent control surface during installation.

Rationale

The install-time remote archive is not pinned independently, and its content is used to populate global Claude Code skills with remotely controlled names. This is an unconsented broad AI-agent control-surface mutation.

Evidence

package.jsonscripts/postinstall.jsscripts/postinstall-helpers.jslib/SKILL.md.template~/.uniner-cli-rpa/<version>/~/.claude/skills/uniner-cli-rpa/SKILL.md~/.claude/skills/<remote-skill-name>/SKILL.md

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

12// 6. Render SKILL.md.template with {{INSTALL_PATH}} / {{VERSION}} substituted L13: // and write to ~/.claude/skills/uniner-cli-rpa/SKILL.md. L14: // 7. Print "ready" and how to validate. ... L215: const dir = skillDir(); L216: fs.mkdirSync(dir, { recursive: true }); L217: L218: // IMPORTANT: only writeFileSync the single SKILL.md file. Do NOT touch L219: // anything else under ~/.claude/skills/uniner-cli-rpa/. In particular, the L220: // scenarios/ subdirectory is the user's accumulated knowledge — if we ... L222: // upgrade. Single-file write is the contract. L223: fs.writeFileSync(skillFile(), content, 'utf8'); L224: log(` SKILL.md written to ${skillFile()}`);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L12

10// 4. Verify SHA-256. L11: // 5. Extract via PowerShell's Expand-Archive (no native dep). L12: // 6. Render SKILL.md.template with {{INSTALL_PATH}} / {{VERSION}} substituted ... L24: const os = require('os'); L25: const https = require('https'); L26: const crypto = require('crypto'); ... L87: res.on('end', () => { L88: try { resolve(JSON.parse(buf)); } L89: catch (e) { reject(new Error(`Bad JSON from ${url}: ${e.message}`)); } ... L123: received += chunk.length; L124: file.write(chunk); L125:

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L10

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ync(skilldir, { recursive: true }); fs.writefilesync(destpath, content, 'utf8'); log(` skill installed: ${skillname} → ${destpath}`); installedcount++; } catch (e) { log(` [warn] failed to install skill ${skillfile}: ${e.message}`); } } if (installedcount > 0) { log(` total skills installed: ${installedcount}`); } }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = uniner-cli-rpa@1.0.0 matchedPath = scripts/postinstall.js matchedIdentity = npm:dW5pbmVyLWNsaS1ycGE:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 73c444699376453d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = uniner-cli-rpa@1.0.0 matchedPath = scripts/postinstall.js matchedIdentity = npm:dW5pbmVyLWNsaS1ycGE:1.0.0 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 10-50json

10 "excel",

11 "ocr",

12 "claude-code",

13 "ai-agent",

14 "cloud-flow",

15 "uniner-cloud"

16 ],

17 "homepage": "https://www.uniner.com/",

18 "bugs": {

19 "url": "https://www.uniner.com/",

20 "email": "support@uniner.com"

21 },

22 "license": "Proprietary",

23 "author": "Uniner Tech",

24 "main": "lib/paths.js",

25 "bin": {

26 "uniner-cli-rpa": "bin/uniner-cli-rpa.js",

27 "uniner-cli-rpa-uninstall": "bin/uniner-cli-rpa-uninstall.js"

28 },

29 "scripts": {

30 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "preuninstall": "node scripts/preuninstall.js"

32 },

33 "engines": {

34 "node": ">=14"

35 },

36 "os": [

37 "win32",

38 "darwin",

39 "linux"

40 ],

41 "cpu": [

42 "x64",

43 "arm64"

44 ],

45 "files": [

46 "bin/",

47 "lib/",

48 "scripts/",

49 "README.md",

50 "LICENSE"

scripts/postinstall.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// postinstall.js — runs after `npm install -g uniner-cli-rpa`.

3//

4// What it does:

5// 1. If the binary is already in place at ~/.uniner-cli-rpa/<version>/, exit (idempotent).

6// 2. Fetch latest.json from the OSS metadata URL to get portable_url + sha256.

7// 3. Stream-download the matching portable .zip into %TEMP%.

8// - Live progress every 2 seconds.

9// - Up to 3 retries with exponential backoff.

10// 4. Verify SHA-256.