registry / Destructive action / @ohos-ports/tencentcloud-tmeet
@ohos-ports/tencentcloud-tmeet
腾讯会议 CLI 工具 (HarmonyOS ARM64)
This report shows the evidence for @ohos-ports/tencentcloud-tmeet@1.0.16-beta.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package performs a concrete destructive credential action automatically at install time. The native binary is opaque, and no installation need justifies clearing an existing user's authentication state.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation on a supported platform with the bundled binary present.
Impact
Existing local Tencent Meeting CLI authentication credentials can be removed during installation.
Mechanism
Postinstall execution of a native binary with forced auth logout.
Attack narrative
The package registers a postinstall hook that chmods and executes its opaque native binary. The hook passes the fixed command `auth logout`; the package documentation says this command clears locally stored authentication credentials. This destructive action occurs during installation, without the user requesting logout.
AI rationale
The package performs a concrete destructive credential action automatically at install time. The native binary is opaque, and no installation need justifies clearing an existing user's authentication state.
Evidence
package.jsonscripts/cleanup.jsREADME.mddist/tmeet-openharmony-arm64
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest automatically runs a postinstall hook.
- The hook makes the bundled binary executable and runs its logout command without user input.
- The package documentation states that logout clears locally stored authentication credentials.
- The executed payload is a stripped native ARM64 binary, so its credential-deletion implementation is opaque.
Evidence against
- The launcher uses a fixed executable path and fixed arguments rather than shell interpolation.
- No self-dependency or source-level network request occurs in the lifecycle JavaScript.
Behavioral surface
ChildProcessFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/cleanup.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg8"scripts": {
"postinstall": "node scripts/cleanup.js"
}
High
Suspicious Lifecycle Evidence
The manifest automatically runs a postinstall hook.
package.jsonView on unpkg · L8scripts/tmeet.jsView file
7if (nodeMajor < 14) {
L8: var _platform = process.platform;
L9: var upgradeHint = "";
...
L12: " # 推荐使用 nvm（Node 版本管理器）：\n" +
L13: " curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash\n" +
L14: " nvm install 18\n" +
...
L34:
L35: const { execFileSync } = require("child_process");
L36: const path = require("path");
...
L61:
L62: const binaryPath = path.join(__dirname, "..", "dist", binaryName);
L63:
High
Findings
5 High2 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityscripts/tmeet.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/cleanup.js
HighAi Review EvidenceREADME.md
MediumShips Native Binarydist/tmeet-openharmony-arm64
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ohos-ports/tencentcloud-tmeet@1.0.16-beta.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ohos-ports/tencentcloud-tmeet@1.0.16-beta.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.