Loading npm security reports…

@okx_ai/okx-trade-mcp@1.4.5: Malicious npm security report | LPM Firewall

registry / @okx_ai/okx-trade-mcp / 1.4.5

@okx_ai/okx-trade-mcp@1.4.5

OKX MCP Server - Model Context Protocol server for OKX exchange

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A postinstall hook downloads opaque platform-native binaries into the user's home directory. The main program later executes those binaries, including to obtain an OAuth access token.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation, followed by normal MCP requests requiring proxy resolution or authentication.

Impact

A package-controlled CDN response can place executable code in the user's home directory and have it run with the user's privileges; the authentication binary is also trusted with an access token.

Mechanism

Automatic remote native-binary delivery followed by runtime process execution.

Attack narrative

On installation, the package silently downloads platform-native pilot and authentication executables from package-selected CDN hosts into ~/.okx/bin. Its integrity check downloads the expected hash from the same host, so a controlling or compromised host can supply both a binary and matching hash. During ordinary runtime, the JavaScript executes these binaries; the authentication binary returns an OAuth token that the client uses for requests. This is an unconsented remote executable delivery and execution chain outside the inspected npm artifact.

Rationale

The package contains an automatic install hook that fetches opaque executables and later runs them. Same-origin checksum metadata does not make the remote payload auditable or independently authenticated.

Evidence

package.jsonscripts/postinstall.jsdist/index.js~/.okx/bin/okx-pilot~/.okx/bin/okx-auth

Network endpoints3

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts changed=test:unit

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

12import { Agent } from "undici"; L13: import { execFile } from "child_process"; L14: import { homedir } from "os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L12

1179} L1180: function execAuthTokenWindows(binPath, makePipeName = defaultWindowsPipeName) { L1181: return new Promise((resolve4, reject) => {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1179

1236function getAuthBinaryPath() { L1237: if (process.env.OKX_AUTH_BIN) { L1238: return process.env.OKX_AUTH_BIN; ... L1242: } L1243: function execAuthToken() { L1244: const binPath = getAuthBinaryPath(); ... L1247: function execAuthTokenUnix(binPath) { L1248: return new Promise((resolve4, reject) => { L1249: const child = spawn2(binPath, ["token"], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1236

scripts/postinstall.jsView file

9import { homedir, platform, arch } from 'node:os'; L10: import { get as httpsGet } from 'node:https'; L11: import { get as httpGet } from 'node:http'; ... L14: try { L15: const __dirname = dirname(fileURLToPath(import.meta.url)); L16: const { name, version } = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8')); L17: L18: process.stderr.write('\n'); L19: process.stderr.write(` ${name} v${version}\n`); ... L148: async function downloadPilotBinary() { L149: if (process.env.OKX_PILOT_BINARY_PATH) return; L150:

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

scripts/postinstall.jsView on unpkg · L9

Source & flagged code

7 flagged

package.jsonView file

Lines 22-49json

22 },

23 "keywords": [

24 "okx",

25 "mcp",

26 "model-context-protocol",

27 "trading"

28 ],

29 "dependencies": {

30 "@modelcontextprotocol/sdk": "^1.26.0",

31 "smol-toml": "^1.3.4",

32 "yauzl": "^3.2.1",

33 "undici": "^6.0.0"

34 },

35 "devDependencies": {

36 "@agent-tradekit/core": "file:../core",

37 "@types/node": "^25.2.2",

38 "tsup": "^8.5.1",

39 "tsx": "^4.19.3",

40 "typescript": "^5.9.3"

41 },

42 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L42

43 "build": "tsup && node -e \"const fs=require('fs');fs.mkdirSync('scripts',{recursive:true});fs.copyFileSync('../../scripts/postinstall-notice.js','scripts/postinstall.js')\"",

44 "typecheck": "tsc --noEmit",

45 "clean": "rm -rf dist scripts",

46 "postinstall": "node scripts/postinstall.js || exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "test:unit": "node_modules/.bin/tsx --test --test-reporter=spec test/*.test.ts"

48 }

49}

dist/index.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2

3// src/index.ts

4import { parseArgs } from "util";

5import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

6

7// ../core/dist/index.js

8import { EnvHttpProxyAgent, setGlobalDispatcher }

scripts/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Shared postinstall script — do not edit the copies in packages/*/scripts/

3// This file is the single source of truth; copies are generated during build.

4

5import { readFileSync, createWriteStream, mkdirSync, chmodSync, existsSync, unlinkSync, renameSync } from 'node:fs';

6import { createHash } from 'node:crypto';

7import { fileURLToPath }