@onescience/onecode@1.14.50-202607011751

One or more suspicious static signals were detected.

npm install postinstall, then later onecode CLI execution

Remote endpoint or network attacker can supply the executable that becomes the package CLI binary.

install-time remote binary download without TLS validation or integrity check

On install, package.json runs postinstall.mjs, which calls platform-bootstrap.mjs. If the platform package is absent, it downloads a versioned tgz from a hardcoded IP over HTTPS with certificate verification disabled, extracts it with tar, installs the binary under node_modules, chmods it executable, and links/copies it to bin/.onecode. The wrapper later spawns that binary for user CLI invocations.

This package uses an npm lifecycle hook to install an opaque executable from a hardcoded remote IP with certificate validation disabled and no source-visible integrity check. That creates a concrete staged payload delivery path rather than a merely user-invoked package-aligned CLI bootstrap.