huiyu-safe-ai

Lightweight AI security guard for install/download commands. Blocks known malicious packages, verifies package identity, and scans for suspicious code — all in under 1 second.
中文 · English
---
**Blocked malicious package — Caught deepseek-py (fake DeepSeek package, confirmed typosquatting)**
**Verified safe repo — Passed huiyu9144/Huiyu-Pi (personal repo, code sniff clean, no malicious behavior)**
---
Design Philosophy
Zero Impact on AI Speed
Huiyu-SafeAi is designed as a **prompt-level guardrail**, not a runtime scanner. It:
- **No network calls** — all checks happen in-memory against embedded lists
- **No commands executed** — no npm audit, no npm view, no external tool calls
- **No file scanning** — code sniffing only reads 3 files max, only when needed
- **No overhead for safe packages** — 90%+ of installs exit at Step 1 or Step 2 instantly
The skill only activates when it detects an install/download command in your message. If you're just chatting, coding, or doing anything else — it stays completely silent.
Three-Tier Check Flow
Works across **all ecosystems** — git clone, npm install, npx, pip install, cargo install, yarn add, pnpm add.
**Step 1 (Blocklist)** — Instant check against 68+ known malicious packages and repos. If matched, blocked immediately with full explanation of why, what happened, and where the intelligence comes from.
**Step 2 (Trust Check)** — If not on the blocklist, check if the source is verified:
- **GitHub**: Does it belong to a trusted org (60+ listed)? Does it have 1,000+ stars?
- **npm/PyPI**: Does it have 10,000+ weekly downloads? Is it the official package name?
- **Known packages**: 70+ trusted packages bypass all checks (express, react, pandas, lodash, etc.)
If trusted → GREEN light, **zero further processing**.
**Step 3 (Code Sniff)** — Only runs for truly unknown sources. Even then, it only reads 3 files max:
- **GitHub repos**: package.json install scripts, setup.py/pyproject.toml, Makefile/Dockerfile
- **npm packages**: postinstall scripts, dependency tree, source code patterns
- **Any source**: One source file glance for obfuscation patterns
---
Why This Exists: A Real Attack
On May 11, 2026, I encountered a real supply chain attack targeting AI developers. This incident is the direct reason Huiyu-SafeAi was created.
What Happened
I requested deployment of **DeepSeek-TUI**, a popular open-source terminal interface (24.1k stars). The correct repository is github.com/Hmbown/DeepSeek-TUI. However, a **fake repository** existed at github.com/DeepSeek-TUI/DeepSeek-TUI — mimicking the project name with a lookalike GitHub organization.
The downloaded executable was an **infostealer trojan** with thread injection, remote payload download, and Telegram data exfiltration capabilities.
The Damage (50+ minutes of incident response)
The trojan performed a devastating chain of attacks in under 10 minutes:
| Time | Action |
|------|--------|
| 09:47 | Trojan executed, released persistent backdoor |
| 09:47 | Created AppData\Roaming\Roaming\Data\Config\manager.exe (12.5MB) — disguised with double-nested Roaming path |
| 09:47 | Added registry auto-start: HKCU\...\Run\{NetworkManager} |
| 09:47 | Opened firewall inbound port **57001** for C2 communication |
| 09:47 | **Disabled Windows Defender** — RealTimeProtection, BehaviorMonitor, IOAV, NIS, OnAccess all turned off |
| 09:47 | Released additional components: svc_host.exe, ~update.tmp.exe |
| 10:37 | Accessed browser data directories for credential theft |
Attribution
This was not a random attack. It was linked to a **known APT group** with a documented pattern:
- **Same group** that ran the OpenClaw impersonation attack in March 2026