registry / @ohos-ports/tencentcloud-tmeet / 1.0.16-beta.0

@ohos-ports/tencentcloud-tmeet@1.0.16-beta.0

腾讯会议 CLI 工具 (HarmonyOS ARM64)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package automatically executes a bundled native binary. It invokes credential logout, which clears local authentication credentials without an explicit user command.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation on a supported platform with the bundled binary present.

Impact

Existing local Tencent Meeting CLI authentication credentials can be removed during installation.

Mechanism

Postinstall execution of a native binary with forced auth logout.

Attack narrative

The package registers a postinstall hook that chmods and executes its opaque native binary. The hook passes the fixed command `auth logout`; the package documentation says this command clears locally stored authentication credentials. This destructive action occurs during installation, without the user requesting logout.

Rationale

The package performs a concrete destructive credential action automatically at install time. The native binary is opaque, and no installation need justifies clearing an existing user's authentication state.

Evidence

package.jsonscripts/cleanup.jsREADME.mddist/tmeet-openharmony-arm64

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

@ohos-ports/tencentcloud-tmeet@1.0.16-beta.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code