Loading npm security reports…

@okx_ai/okx-trade-cli@1.4.4: Malicious npm security report | LPM Firewall

registry / @okx_ai/okx-trade-cli / 1.4.4

@okx_ai/okx-trade-cli@1.4.4

OKX CLI - Command line tool for OKX exchange

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Installation fetches opaque native executables from remote hosts, writes them beneath the user's home directory, and makes them executable. The CLI later executes one of those files.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm automatically invokes postinstall during package installation.

Impact

A remote party controlling a configured download source can deliver code that persists under the user's home directory and is executed by the CLI.

Mechanism

The lifecycle hook downloads a binary and checksum from a CDN, replaces the destination file, and applies executable permissions; the checksum is obtained from the same remote source.

Attack narrative

The install lifecycle runs without an explicit user command. It downloads opaque platform binaries from remote CDN hosts into the user's .okx/bin directory, replaces existing files, and makes them executable. Although it checks a SHA-256 value, both the checksum and binary come from the same remote source. The package's active CLI then invokes the downloaded pilot binary. This creates an automatic remote-code delivery and execution path at install time.

AI rationale

This is concrete install-hook abuse: an automatic postinstall downloads and persists opaque executable code that the package later runs. Same-source checksum validation does not bind the binary to a trusted package artifact.

Evidence

package.jsonscripts/postinstall.jsdist/index.js.okx/bin

Network endpoints3

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts changed=test:unit

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

11import { Agent } from "undici"; L12: import { execFile } from "child_process"; L13: import { homedir } from "os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L11

1354} L1355: function execAuthTokenWindows(binPath, makePipeName = defaultWindowsPipeName) { L1356: return new Promise((resolve4, reject) => {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1354

1411function getAuthBinaryPath() { L1412: if (process.env.OKX_AUTH_BIN) { L1413: return process.env.OKX_AUTH_BIN; ... L1417: } L1418: function execAuthToken() { L1419: const binPath = getAuthBinaryPath(); ... L1422: function execAuthTokenUnix(binPath) { L1423: return new Promise((resolve4, reject) => { L1424: const child = spawn2(binPath, ["token"], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1411

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: writeFileSync, import { writeFileSync as writeFileSync2, renameSync as renameSync2, unlinkSync as unlinkSync2, mkdirSync as mkdirSync2 } from "fs"; import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync2 } from "fs"; import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, existsSync as existsSync3 } from "fs"; import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6, existsSync as existsSync4 } from "fs"; import { readFileSync as readFileSync10, writeFileSync as writeFileSy

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

6// ../core/dist/index.js L7: import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici"; L8: import { ProxyAgent } from "undici"; L9: import { isIP } from "net"; L10: import { lookup as dnsLookup } from "dns"; L11: import { Agent } from "undici"; L12: import { execFile } from "child_process"; L13: import { homedir } from "os"; ... L917: import { homedir as homedir10 } from "os"; L918: function hasProxyEnv(env = process.env) { L919: return Boolean( ... L932: var ALLOWED_DOMAIN_RE = /^[\w.-]+\.okx\.com$/;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = @okx_ai/okx-trade-cli@1.4.5 matchedPath = dist/index.js matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtY2xp:1.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 6709de91de305306 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @okx_ai/okx-trade-cli@1.4.5 matchedPath = dist/index.js matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtY2xp:1.4.5 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

14534import { createRequire } from "module"; L14535: var _require = createRequire(import.meta.url); L14536: function readCliVersion() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L14534

scripts/postinstall.jsView file

9import { homedir, platform, arch } from 'node:os'; L10: import { get as httpsGet } from 'node:https'; L11: import { get as httpGet } from 'node:http'; ... L14: try { L15: const __dirname = dirname(fileURLToPath(import.meta.url)); L16: const { name, version } = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8')); L17: L18: process.stderr.write('\n'); L19: process.stderr.write(` ${name} v${version}\n`); ... L148: async function downloadPilotBinary() { L149: if (process.env.OKX_PILOT_BINARY_PATH) return; L150:

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

scripts/postinstall.jsView on unpkg · L9

Source & flagged code

12 flagged

package.jsonView file

Lines 3-43json

3 "version": "1.4.4",

4 "description": "OKX CLI - Command line tool for OKX exchange",

5 "type": "module",

6 "license": "MIT",

7 "main": "dist/index.js",

8 "bin": {

9 "okx": "dist/index.js"

10 },

11 "files": [

12 "dist",

13 "scripts",

14 "README.md"

15 ],

16 "publishConfig": {

17 "access": "public"

18 },

19 "scripts": {

20 "build": "tsup && node -e \"const fs=require('fs');fs.mkdirSync('scripts',{recursive:true});fs.copyFileSync('../../scripts/postinstall-notice.js','scripts/postinstall.js')\"",

21 "typecheck": "tsc --noEmit",

22 "clean": "rm -rf dist scripts",

23 "postinstall": "node scripts/postinstall.js || exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "test:unit": "node_modules/.bin/tsx --test --test-reporter=spec test/*.test.ts",

25 "test:coverage": "c8 --reporter=lcov --reporter=text --src=src node_modules/.bin/tsx --test test/*.test.ts"

26 },

27 "engines": {

28 "node": ">=18"

29 },

30 "keywords": [

31 "okx",

32 "cli",

33 "trading"

34 ],

35 "dependencies": {

36 "undici": "^6.0.0",

37 "yauzl": "^3.2.1"

38 },

39 "devDependencies": {

40 "@agent-tradekit/core": "file:../core",

41 "@types/node": "^25.2.2",

42 "c8": "^10.1.3",

43 "tsup": "^8.5.1",

•scripts changed=test:unit

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

dist/index.jsView file

11import { Agent } from "undici"; L12: import { execFile } from "child_process"; L13: import { homedir } from "os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L11

1354} L1355: function execAuthTokenWindows(binPath, makePipeName = defaultWindowsPipeName) { L1356: return new Promise((resolve4, reject) => {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1354

1411function getAuthBinaryPath() { L1412: if (process.env.OKX_AUTH_BIN) { L1413: return process.env.OKX_AUTH_BIN; ... L1417: } L1418: function execAuthToken() { L1419: const binPath = getAuthBinaryPath(); ... L1422: function execAuthTokenUnix(binPath) { L1423: return new Promise((resolve4, reject) => { L1424: const child = spawn2(binPath, ["token"], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1411

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: writeFileSync, import { writeFileSync as writeFileSync2, renameSync as renameSync2, unlinkSync as unlinkSync2, mkdirSync as mkdirSync2 } from "fs"; import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync2 } from "fs"; import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, existsSync as existsSync3 } from "fs"; import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6, existsSync as existsSync4 } from "fs"; import { readFileSync as readFileSync10, writeFileSync as writeFileSy

scripts/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Shared postinstall script — do not edit the copies in packages/*/scripts/

3// This file is the single source of truth; copies are generated during build.

4

5import { readFileSync, createWriteStream, mkdirSync, chmodSync, existsSync, unlinkSync, renameSync } from 'node:fs';

6import { createHash } from 'node:crypto';

7import { fileURLToPath }