@byteplus/ark-cli@1.0.20: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@byteplus/ark-cli@1.0.20: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

300async function downloadVerifiedBinary(sources, destination, expectedSHA) { const errors = []; for (const source of sources) { fs.rmSync(destination, { force: true }); try { console.log(`${PACKAGE_NAME}: downloading ${key} binary from ${source.kind}...`); await download(source.url, destination, source.kind); const actual = await sha256(destination); if (actual !== expectedSHA.toLowerCase()) { throw new Error(`sha256 mismatch (expected ${expectedSHA}, actual ${actual})`); }

Medium

Suspicious Lifecycle Evidence

postinstall downloads a platform binary, verifies it, then installs it.

scripts/postinstall.jsView on unpkg · L300

347fs.mkdirSync(binDir, { recursive: true }); recoverInterruptedInstall(binPath, backupPath); let installedFrom; try { const sources = [{ kind: "cdn", url: entry.url }]; if (!isNonStable) { sources.push({ kind: "github-release", url: entry.fallback.url }); } installedFrom = await downloadVerifiedBinary( sources, tempPath, entry.sha256, ); } catch (err) { fs.rmSync(tempPath, { force: true }); throw new Error(`binary download failed: ${err.message || err}`); } let oldMoved = false; let newInstalled = false; try { if (pl

Medium

Suspicious Lifecycle Evidence

postinstall downloads a platform binary, verifies it, then installs it.

scripts/postinstall.jsView on unpkg · L347

489let tty = null; try { tty = fs.openSync("/dev/tty", "r+"); } catch (_) { // A controlling terminal is optional; +connect is still non-interactive. } const stdio = tty === null ? "inherit" : ["ignore", tty, tty]; try { execFileSync(binPath, ["+connect", "--refresh"], { stdio }); } catch (err) { const message = `${PACKAGE_NAME}: Skill sync skipped (${err.message || err}). ` + "Run `arkcli +connect --refresh` to retry.";

Medium

Suspicious Lifecycle Evidence

The lifecycle script executes the downloaded binary with +connect --refresh without a user command.

scripts/postinstall.jsView on unpkg · L489

399if (process.env.npm[redacted] === "true") { // Enrollment publishes only inert exact-install evidence. Active consent // can be created only by later successful human CLI invocations. let bootstrapReady = process.platform !== "win32"; let bootstrapError; if (process.platform === "win32") { try { execFileSync(binPath, ["_initialize-update-bootstrap"], { timeout: 120000, stdio: "ignore", });

Medium

Ai Review Evidence

Global installs invoke binary update-bootstrap/cache commands and advertise silent patch updates.

scripts/postinstall.jsView on unpkg · L399

Lines 469-509javascript

469 } else if (policyError) {

470 writeInstallNotice(

471 `${PACKAGE_NAME}: automatic-update capability could not be confirmed; this install remains notice/manual-only (${policyError.message || policyError})`,

472 true,

473 );

474 } else if (automaticSupported === false) {

475 writeInstallNotice(`${PACKAGE_NAME}: update notices/manual update remain active by default; silent automatic update is not enabled for this product and platform.`);

476 } else if (enrollmentPhase === "fresh_pending") {

477 writeInstallNotice(`${PACKAGE_NAME}: silent stable patch updates are enabled by default for this new install; the first human command will not update. Disable with \`arkcli config set update.mode disabled\`.`);

478 } else if (enrollmentPhase === "manual_reinstall_suspended") {

479 writeInstallNotice(`${PACKAGE_NAME}: a manual npm install or version change was detected, so silent automatic updates are paused. Keep this version with \`arkcli config set update.mode disabled\`; resume with \`arkcli config set update.mode automatic\`.`);

480 } else if (enrollmentPhase === "disabled" || mode === "disabled") {

481 writeInstallNotice(`${PACKAGE_NAME}: the disabled update policy was preserved; update notices remain active and silent automatic update is not active.`);

482 } else if (enrollmentPhase === "grace_completed") {

483 writeInstallNotice(`${PACKAGE_NAME}: first-run grace is complete; the next successful human command only activates exact-install consent and will not update immediately. Disable with \`arkcli config set update.mode disabled\`.`);

484 } else if (enrollmentPhase === "automatic_active") {

485 writeInstallNotice(`${PACKAGE_NAME}: silent stable patch update consent remains active for this exact install. Disable with \`arkcli config set update.mode disabled\`.`);

486 }

487 }

488

489 let tty = null;

490 try {

491 tty = fs.openSync("/dev/tty", "r+");

492 } catch (_) {

493 // A controlling terminal is optional; +connect is still non-interactive.

494 }

495 const stdio = tty === null ? "inherit" : ["ignore", tty, tty];

496 try {

497 execFileSync(binPath, ["+connect", "--refresh"], { stdio });

498 } catch (err) {

499 const message =

500 `${PACKAGE_NAME}: Skill sync skipped (${err.message || err}). ` +

Medium

Suspicious Lifecycle Evidence

The lifecycle script executes the downloaded binary with +connect --refresh without a user command.

scripts/postinstall.jsView on unpkg · L489

501 "Run `arkcli +connect --refresh` to retry.";

502 if (tty === null) {

503 console.warn(message);

504 } else {

505 try {

506 fs.writeSync(tty, `${message}\n`);

507 } catch (_) {}

508 }

509 } finally {