registry / @okx_ai/okx-trade-mcp / 1.4.4

@okx_ai/okx-trade-mcp@1.4.4

OKX MCP Server - Model Context Protocol server for OKX exchange

AI Security Review

scanned 18d ago · by lpm-firewall-ai

An npm postinstall hook downloads remote native binaries into the user's home directory and makes them executable. The package runtime subsequently executes the pilot binary.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package triggers postinstall; normal runtime network handling can invoke the installed pilot binary.

Impact

A remote operator controlling a download source and its checksum metadata can supply code that is later executed on the user's machine.

Mechanism

The installer retrieves a binary from one of three remote hosts, replaces the local .okx/bin file, and sets executable permissions. The runtime passes that file to execFile.

Attack narrative

Package installation automatically stages a remotely hosted executable in the user's home directory. The verification data is also retrieved from the selected remote source, so it does not establish an independent trust boundary. Runtime code then executes the staged pilot binary. This creates a supply-chain path from an install-time download to local code execution without an explicit user command.

AI rationale

The automatic lifecycle hook downloads and installs remotely controlled executables, then runtime code executes one of them. This is a concrete remote-code-execution supply-chain path, not ordinary API-client networking.

Evidence

package.jsonscripts/postinstall.jsdist/index.js

Network endpoints3

static.jingyunyilian.comstatic.okx.comstatic.coinall.ltd

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs its downloader automatically through an npm postinstall hook.
The install script selects remote CDN hosts and writes binaries into the user's .okx/bin directory.
The downloaded pilot binary is replaced and marked executable during installation.
The runtime later invokes that installed binary with child_process.

Evidence against

The installer checks the downloaded file against checksum metadata, but it obtains that metadata from the same remote source.
The setup code that writes AI-client configuration is activated only by the explicit setup command.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 515 KB of source, external domains: app.okx.com, eea.okx.com, my.okx.com, registry.npmjs.org, tr.okx.com, us.okx.com, www.okx.com

Source & flagged code

8 flagged

package.jsonView file

Lines 1-44json

2 "name": "@okx_ai/okx-trade-mcp",

3 "version": "1.4.4",

4 "description": "OKX MCP Server - Model Context Protocol server for OKX exchange",

5 "type": "module",

6 "license": "MIT",

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "bin": {

10 "okx-trade-mcp": "dist/index.js"

11 },

12 "files": [

13 "dist",

14 "scripts",

15 "README.md"

16 ],

17 "publishConfig": {

18 "access": "public"

19 },

20 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L20

21 "build": "tsup && node -e \"const fs=require('fs');fs.mkdirSync('scripts',{recursive:true});fs.copyFileSync('../../scripts/postinstall-notice.js','scripts/postinstall.js')\"",

22 "typecheck": "tsc --noEmit",

23 "clean": "rm -rf dist scripts",

24 "postinstall": "node scripts/postinstall.js || exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "test:unit": "node_modules/.bin/tsx --test --test-reporter=spec test/*.test.ts"

26 },

27 "engines": {

28 "node": ">=18"

29 },

30 "keywords": [

31 "okx",

32 "mcp",

33 "model-context-protocol",

34 "trading"

35 ],

36 "dependencies": {

37 "@modelcontextprotocol/sdk": "^1.26.0",

38 "smol-toml": "^1.3.4",

39 "yauzl": "^3.2.1",

40 "undici": "^6.0.0"

41 },

42 "devDependencies": {

43 "@agent-tradekit/core": "file:../core",

44 "@types/node": "^25.2.2",

dist/index.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

3// src/index.ts

4import { parseArgs } from "util";

5import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

7// ../core/dist/index.js

8import { EnvHttpProxyAgent, setGlobalDispatcher }

scripts/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Shared postinstall script — do not edit the copies in packages/*/scripts/

3// This file is the single source of truth; copies are generated during build.

5import { readFileSync, createWriteStream, mkdirSync, chmodSync, existsSync, unlinkSync, renameSync } from 'node:fs';

6import { createHash } from 'node:crypto';

7import { fileURLToPath }

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts changed=test:unit

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

12import { Agent } from "undici"; L13: import { execFile } from "child_process"; L14: import { homedir } from "os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L12

1236function getAuthBinaryPath() { L1237: if (process.env.OKX_AUTH_BIN) { L1238: return process.env.OKX_AUTH_BIN; ... L1242: } L1243: function execAuthToken() { L1244: const binPath = getAuthBinaryPath(); ... L1247: function execAuthTokenUnix(binPath) { L1248: return new Promise((resolve4, reject) => { L1249: const child = spawn2(binPath, ["token"], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1236

•matchType = normalized_sha256 matchedPackage = @okx_ai/okx-trade-mcp@1.4.5 matchedPath = dist/index.js matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtbWNw:1.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 285e4d2d1f1a3ce6 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @okx_ai/okx-trade-mcp@1.4.5 matchedPath = dist/index.js matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtbWNw:1.4.5 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

scripts/postinstall.jsView file

9import { homedir, platform, arch } from 'node:os'; L10: import { get as httpsGet } from 'node:https'; L11: import { get as httpGet } from 'node:http'; ... L14: try { L15: const __dirname = dirname(fileURLToPath(import.meta.url)); L16: const { name, version } = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8')); L17: L18: process.stderr.write('\n'); L19: process.stderr.write(` ${name} v${version}\n`); ... L148: async function downloadPilotBinary() { L149: if (process.env.OKX_PILOT_BINARY_PATH) return; L150:

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

scripts/postinstall.jsView on unpkg · L9

Findings

1 Critical6 High4 Medium4 Low

CriticalManifest Confusionpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighHost Fingerprint Exfiltrationscripts/postinstall.js

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Fingerprint Signaturedist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @okx_ai/okx-trade-mcp@1.4.4.

See version security history for other recorded verdicts.

Avoid installing @okx_ai/okx-trade-mcp@1.4.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-20 07:04:20.302Z (UTC).