Loading npm security reports…

@okx_ai/okx-trade-mcp@1.4.7: Malicious npm security report | LPM Firewall

registry / @okx_ai/okx-trade-mcp / 1.4.7

@okx_ai/okx-trade-mcp@1.4.7

OKX MCP Server - Model Context Protocol server for OKX exchange

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The postinstall hook downloads two native binaries automatically and writes them to ~/.okx/bin. Runtime code subsequently executes those binaries.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation, followed by normal MCP runtime use.

Impact

A compromised or malicious payload host can supply code that later executes as the installing user.

Mechanism

Remote binary download with remote-controlled checksum followed by native-process execution.

Attack narrative

Installing the package invokes postinstall, which retrieves checksum metadata and native binaries from remote CDN hosts, writes them to ~/.okx/bin, and marks them executable. The checksum is fetched from the same unpinned remote source as the payload, so it does not independently authenticate the binary. The bundled runtime then launches both downloaded binaries, creating a remote payload execution chain under the user's account.

AI rationale

This is an automatic remote-native-payload bootstrap whose trust decision is controlled by the payload source itself, followed by execution of the resulting binaries. That install-to-execution chain is concrete malicious install-hook abuse.

Evidence

package.jsonscripts/postinstall.jsdist/index.js~/.okx/bin/okx-pilot~/.okx/bin/okx-auth

Network endpoints3

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts changed=test:unit

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @okx_ai/okx-trade-mcp@1.4.3 matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtbWNw:1.4.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

154import { Agent } from "undici"; L155: import { execFile } from "child_process"; L156: import { homedir as homedir2 } from "os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L154

1318} L1319: function execAuthTokenWindows(binPath, makePipeName = defaultWindowsPipeName) { L1320: return new Promise((resolve4, reject) => {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1318

1375function getAuthBinaryPath() { L1376: if (process.env.OKX_AUTH_BIN) { L1377: return process.env.OKX_AUTH_BIN; ... L1381: } L1382: function execAuthToken() { L1383: const binPath = getAuthBinaryPath(); ... L1386: function execAuthTokenUnix(binPath) { L1387: return new Promise((resolve4, reject) => { L1388: const child = spawn2(binPath, ["token"], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1375

•matchType = normalized_sha256 matchedPackage = @okx_ai/okx-trade-mcp@1.4.6 matchedPath = dist/index.js matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtbWNw:1.4.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = f457f319b4f96777 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @okx_ai/okx-trade-mcp@1.4.6 matchedPath = dist/index.js matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtbWNw:1.4.6 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

scripts/postinstall.jsView file

9import { homedir, platform, arch } from 'node:os'; L10: import { get as httpsGet } from 'node:https'; L11: import { get as httpGet } from 'node:http'; ... L14: try { L15: const __dirname = dirname(fileURLToPath(import.meta.url)); L16: const { name, version } = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8')); L17: L18: process.stderr.write('\n'); L19: process.stderr.write(` ${name} v${version}\n`); ... L148: async function downloadPilotBinary() { L149: if (process.env.OKX_PILOT_BINARY_PATH) return; L150:

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

scripts/postinstall.jsView on unpkg · L9

Source & flagged code

10 flagged

package.jsonView file

Lines 22-49json

22 },

23 "keywords": [

24 "okx",

25 "mcp",

26 "model-context-protocol",

27 "trading"

28 ],

29 "dependencies": {

30 "@modelcontextprotocol/sdk": "^1.26.0",

31 "smol-toml": "^1.3.4",

32 "yauzl": "^3.2.1",

33 "undici": "^6.0.0"

34 },

35 "devDependencies": {

36 "@agent-tradekit/core": "file:../core",

37 "@types/node": "^25.2.2",

38 "tsup": "^8.5.1",

39 "tsx": "^4.19.3",

40 "typescript": "^5.9.3"

41 },

42 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L42

43 "build": "tsup && node -e \"const fs=require('fs');fs.mkdirSync('scripts',{recursive:true});fs.copyFileSync('../../scripts/postinstall-notice.js','scripts/postinstall.js')\"",

44 "typecheck": "tsc --noEmit",

45 "clean": "rm -rf dist scripts",

46 "postinstall": "node scripts/postinstall.js || exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "test:unit": "node_modules/.bin/tsx --test --test-reporter=spec test/*.test.ts"

48 }

49}

dist/index.jsView file

Lines 134-174javascript

134 if (entry && entry.latestVersion && isNewerVersion(currentVersion, entry.latestVersion)) {

135 process.stderr.write(

136 `

137Update available for ${packageName}: ${currentVersion} -> ${entry.latestVersion}

scripts/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Shared postinstall script — do not edit the copies in packages/*/scripts/

3// This file is the single source of truth; copies are generated during build.

4

5import { readFileSync, createWriteStream, mkdirSync, chmodSync, existsSync, unlinkSync, renameSync } from 'node:fs';

6import { createHash } from 'node:crypto';

7import { fileURLToPath }