registry / AI-agent control-surface risk / @byteplus/ark-cli
@byteplus/ark-cli
BytePlus Ark command-line interface
This report shows the evidence for @byteplus/ark-cli@1.0.24. 1 of 22 known versions is blocked or flagged. The newest version, 1.0.39, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete unconsented postinstall agent-integration action performed by an opaque downloaded executable. Digest verification limits replacement risk but does not make the automatic control-surface mutation consensual.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm postinstall
Impact
Unconsented modification of an AI-agent control surface by code not included in the package snapshot.
Mechanism
downloaded native binary executes +connect --refresh
Policy narrative
Installing the package runs a lifecycle hook that downloads a platform-native executable from a remote manifest, verifies its digest, and executes it. The hook then invokes the executable with +connect --refresh without requiring an explicit user command. Because the executable is absent from the inspected package and the command is intended to connect Skills to local agents, installation can alter an external AI-agent control surface without consent.
AI rationale
This is a concrete unconsented postinstall agent-integration action performed by an opaque downloaded executable. Digest verification limits replacement risk but does not make the automatic control-surface mutation consensual.
Evidence
package.jsonscripts/postinstall.jsmanifest.jsonbin
Network endpoints2
sf16-sg.tiktokcdn.comgithub.com/byteplus-sdk/ark-cli/releases/download/
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest runs scripts/postinstall.js automatically after npm installation.
- The install hook downloads a native binary, verifies it, and places it under bin.
- The install hook executes that downloaded binary with +connect --refresh even when no terminal is available.
- The README presents +connect as a later user command, but the lifecycle hook invokes it automatically.
Evidence against
- The downloader requires HTTPS, restricts the GitHub fallback, and checks a SHA-256 digest.
- The inspected JavaScript does not itself harvest credentials or send local data.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg15"scripts": {
"postinstall": "node scripts/postinstall.js"
},
High
Suspicious Lifecycle Evidence
The manifest runs scripts/postinstall.js automatically after npm installation.
package.jsonView on unpkg · L15•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.js#virtual:normalized:round1View file
Findings
7 High3 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedscripts/postinstall.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltascripts/postinstall.js
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencescripts/postinstall.js
HighSuspicious Lifecycle Evidencescripts/postinstall.js
HighSuspicious Lifecycle Evidencemanifest.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @byteplus/ark-cli@1.0.24.
The versions list below shows the verdict for each recorded version.
- Avoid installing @byteplus/ark-cli@1.0.24. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
22 known versions1.0.39latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 15, 2026, 3:29 PM1.0.38SuspiciousAgent extension lifecycle riskWarnPublishedOct 10, 2026, 4:07 PM1.0.37SuspiciousAgent extension lifecycle riskWarnPublishedSep 29, 2026, 1:49 PM1.0.36SuspiciousAgent extension lifecycle riskWarnPublishedSep 24, 2026, 2:18 PM