Loading npm security reports…

@okx_ai/okx-trade-mcp@1.4.8: Malicious npm security report | LPM Firewall

registry / @okx_ai/okx-trade-mcp / 1.4.8

@okx_ai/okx-trade-mcp@1.4.8

OKX MCP Server - Model Context Protocol server for OKX exchange

AI Security Review

scanned 14d ago · by lpm-firewall-ai

npm install runs a postinstall script that downloads native okx-pilot and okx-auth binaries into ~/.okx/bin. The first host, static.jingyunyilian.com, supplies both the binary and its checksum. The MCP server later executes those files.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install lifecycle postinstall, then a later run of the MCP server that calls the pilot or auth helper.

Impact

A response from the CDN becomes a user-privileged native executable on the machine without a hash pinned in the published package.

Mechanism

scripts/postinstall.js fetches the platform binary over HTTPS, accepts a checksum.json from the same host, writes it under the user home directory, and marks it executable. dist/index.js then execFile or spawn that path.

Attack narrative

Installing the package runs scripts/postinstall.js. That script downloads okx-pilot and okx-auth into ~/.okx/bin, trying static.jingyunyilian.com before static.okx.com and static.coinall.ltd. The checksum is taken from the same host, so the package does not pin the binary hash. The file is made executable. When the server later needs a pilot route or an auth token, dist/index.js executes that downloaded binary with the user privileges.

AI rationale

The postinstall hook fetches native binaries from a CDN and makes them executable, using a checksum served by the same host, including static.jingyunyilian.com. The published server then executes those binaries, so install can turn a remote response into local code.

Evidence

package.jsonscripts/postinstall.jsdist/index.js~/.okx/bin/okx-pilot

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts changed=test:unit

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @okx_ai/okx-trade-mcp@1.4.3 matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtbWNw:1.4.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

154import { Agent } from "undici"; L155: import { execFile } from "child_process"; L156: import { homedir as homedir2 } from "os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L154

1375function getAuthBinaryPath() { L1376: if (process.env.OKX_AUTH_BIN) { L1377: return process.env.OKX_AUTH_BIN; ... L1381: } L1382: function execAuthToken() { L1383: const binPath = getAuthBinaryPath(); ... L1386: function execAuthTokenUnix(binPath) { L1387: return new Promise((resolve4, reject) => { L1388: const child = spawn2(binPath, ["token"], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1375

•matchType = normalized_sha256 matchedPackage = @okx_ai/okx-trade-mcp@1.4.7 matchedPath = dist/index.js matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtbWNw:1.4.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = f457f319b4f96777 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @okx_ai/okx-trade-mcp@1.4.7 matchedPath = dist/index.js matchedIdentity = npm:QG9reF9haS9va3gtdHJhZGUtbWNw:1.4.7 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

scripts/postinstall.jsView file

9import { homedir, platform, arch } from 'node:os'; L10: import { get as httpsGet } from 'node:https'; L11: import { get as httpGet } from 'node:http'; ... L14: try { L15: const __dirname = dirname(fileURLToPath(import.meta.url)); L16: const { name, version } = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8')); L17: L18: process.stderr.write('\n'); L19: process.stderr.write(` ${name} v${version}\n`); ... L148: async function downloadPilotBinary() { L149: if (process.env.OKX_PILOT_BINARY_PATH) return; L150:

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

scripts/postinstall.jsView on unpkg · L9

Source & flagged code

9 flagged

package.jsonView file

Lines 22-49json

22 },

23 "keywords": [

24 "okx",

25 "mcp",

26 "model-context-protocol",

27 "trading"

28 ],

29 "dependencies": {

30 "@modelcontextprotocol/sdk": "^1.26.0",

31 "smol-toml": "^1.3.4",

32 "yauzl": "^3.2.1",

33 "undici": "^6.0.0"

34 },

35 "devDependencies": {

36 "@agent-tradekit/core": "file:../core",

37 "@types/node": "^25.2.2",

38 "tsup": "^8.5.1",

39 "tsx": "^4.19.3",

40 "typescript": "^5.9.3"

41 },

42 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L42

43 "build": "tsup && node -e \"const fs=require('fs');fs.mkdirSync('scripts',{recursive:true});fs.copyFileSync('../../scripts/postinstall-notice.js','scripts/postinstall.js')\"",

44 "typecheck": "tsc --noEmit",

45 "clean": "rm -rf dist scripts",

46 "postinstall": "node scripts/postinstall.js || exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "test:unit": "node_modules/.bin/tsx --test --test-reporter=spec test/*.test.ts"

48 }

49}

dist/index.jsView file

Lines 134-174javascript

134 if (entry && entry.latestVersion && isNewerVersion(currentVersion, entry.latestVersion)) {

135 process.stderr.write(

136 `

137Update available for ${packageName}: ${currentVersion} -> ${entry.latestVersion}

scripts/postinstall.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Shared postinstall script — do not edit the copies in packages/*/scripts/

3// This file is the single source of truth; copies are generated during build.

4

5import { readFileSync, createWriteStream, mkdirSync, chmodSync, existsSync, unlinkSync, renameSync } from 'node:fs';

6import { createHash } from 'node:crypto';

7import { fileURLToPath }