@onescience/onecode@1.14.50-202607011501

One or more suspicious static signals were detected.

npm install postinstall, then user invokes onecode CLI

Unverified remote binary can define runtime behavior outside the inspected npm source.

install-time remote native binary download and CLI launcher spawn

During postinstall, the package downloads a platform tarball from a hardcoded IP URL, disables TLS certificate verification, extracts it, and stages a chmodded native binary as bin/.onecode. The package wrapper later spawns that binary for CLI use. Source inspection found no exfiltration or foreign AI-agent control-surface mutation, but the binary payload is remote and unauthenticated from the npm source package.

The package has a real install-time remote payload risk because it stages a native executable from an IP endpoint with certificate verification disabled, but inspected source does not show concrete exfiltration, persistence, or agent control hijack. Treat as suspicious remote payload staging rather than confirmed malware.