@onescience/onecode@1.14.50-202607010646

One or more suspicious static signals were detected.

npm install runs postinstall; invoking onecode runs the installed binary

Remote endpoint can supply arbitrary executable code outside npm package integrity controls

install-time unauthenticated remote binary download and execution wrapper

On install, postinstall.mjs builds a URL under a hardcoded IP host, downloads a tarball with certificate verification disabled, extracts it, moves the extracted package into node_modules, chmods its native binary, and links or copies it to bin/.onecode. The public bin/onecode wrapper resolves that cached binary and spawns it with user arguments.

This package delegates its installed executable to unauthenticated install-time network content, creating a concrete remote code execution supply-chain risk even though the wrapper is CLI-aligned. No source evidence shows credential theft or AI-agent control-surface hijacking.