@okx_ai/okx-trade-cli@1.4.6: Malicious npm security report | LPM Firewall

Loading npm security reports…

@okx_ai/okx-trade-cli@1.4.6: Malicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts changed=test:unit

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @okx_ai/okx-trade-cli@1.4.3 matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtY2xp:1.4.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

163import { Agent } from "undici"; L164: import { execFile } from "child_process"; L165: import { homedir as homedir2 } from "os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L163

1503} L1504: function execAuthTokenWindows(binPath, makePipeName = defaultWindowsPipeName) { L1505: return new Promise((resolve4, reject) => {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1503

1560function getAuthBinaryPath() { L1561: if (process.env.OKX_AUTH_BIN) { L1562: return process.env.OKX_AUTH_BIN; ... L1566: } L1567: function execAuthToken() { L1568: const binPath = getAuthBinaryPath(); ... L1571: function execAuthTokenUnix(binPath) { L1572: return new Promise((resolve4, reject) => { L1573: const child = spawn2(binPath, ["token"], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1560

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs"; writeFileSync(CACHE_FILE, JSON.stringify(cache, null, 2), "utf-8"); writeFileSync as writeFileSync2, import { writeFileSync as writeFileSync22, renameSync as renameSync2, unlinkSync as unlinkSync2, mkdirSync as mkdirSync22 } from "fs"; import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync22 } from "fs"; import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, existsSync as existsSync3 } from "fs"; import { readFileSync as readFileSync9, writ

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

scripts/postinstall.jsView file

9import { homedir, platform, arch } from 'node:os'; L10: import { get as httpsGet } from 'node:https'; L11: import { get as httpGet } from 'node:http'; ... L14: try { L15: const __dirname = dirname(fileURLToPath(import.meta.url)); L16: const { name, version } = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8')); L17: L18: process.stderr.write('\n'); L19: process.stderr.write(` ${name} v${version}\n`); ... L148: async function downloadPilotBinary() { L149: if (process.env.OKX_PILOT_BINARY_PATH) return; L150:

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

scripts/postinstall.jsView on unpkg · L9

Source & flagged code

9 flagged

package.jsonView file

Lines 19-47json

19 "engines": {

20 "node": ">=18"

21 },

22 "keywords": [

23 "okx",

24 "cli",

25 "trading"

26 ],

27 "dependencies": {

28 "undici": "^6.0.0",

29 "yauzl": "^3.2.1"

30 },

31 "devDependencies": {

32 "@agent-tradekit/core": "file:../core",

33 "@types/node": "^25.2.2",

34 "c8": "^10.1.3",

35 "tsup": "^8.5.1",

36 "tsx": "^4.19.3",

37 "typescript": "^5.9.3"

38 },

39 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L39

40 "build": "tsup && node -e \"const fs=require('fs');fs.mkdirSync('scripts',{recursive:true});fs.copyFileSync('../../scripts/postinstall-notice.js','scripts/postinstall.js')\"",

41 "typecheck": "tsc --noEmit",

42 "clean": "rm -rf dist scripts",

43 "postinstall": "node scripts/postinstall.js || exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "test:unit": "node_modules/.bin/tsx --test --test-reporter=spec test/*.test.ts",

45 "test:coverage": "c8 --reporter=lcov --reporter=text --src=src node_modules/.bin/tsx --test test/*.test.ts"

46 }

47}

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @okx_ai/okx-trade-cli@1.4.3 matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtY2xp:1.4.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

163import { Agent } from "undici"; L164: import { execFile } from "child_process"; L165: import { homedir as homedir2 } from "os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L163

1503} L1504: function execAuthTokenWindows(binPath, makePipeName = defaultWindowsPipeName) { L1505: return new Promise((resolve4, reject) => {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1503

1560function getAuthBinaryPath() { L1561: if (process.env.OKX_AUTH_BIN) { L1562: return process.env.OKX_AUTH_BIN; ... L1566: } L1567: function execAuthToken() { L1568: const binPath = getAuthBinaryPath(); ... L1571: function execAuthTokenUnix(binPath) { L1572: return new Promise((resolve4, reject) => { L1573: const child = spawn2(binPath, ["token"], {

scripts/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Shared postinstall script — do not edit the copies in packages/*/scripts/

3// This file is the single source of truth; copies are generated during build.

4

5import { readFileSync, createWriteStream, mkdirSync, chmodSync, existsSync, unlinkSync, renameSync } from 'node:fs';

6import { createHash } from 'node:crypto';

7import { fileURLToPath }