@onescience/onecode@1.14.50-202607021504

One or more suspicious static signals were detected.

npm install postinstall lifecycle when platform package is missing

A remote server can supply executable code that becomes the onecode CLI without registry-published source or integrity protection.

install-time unverified remote binary download and staging

During npm install, the postinstall script imports platform-bootstrap.mjs and ensures a platform binary exists. If not found locally, it constructs a tgz URL under a hardcoded IP host, downloads it with certificate verification disabled, extracts it with tar, chmods the binary, and links/copies it to bin/.onecode. That stages opaque executable code outside npm registry integrity guarantees.

The source establishes a concrete install-time remote payload path with disabled TLS verification and no integrity check. Even without credential theft or immediate binary execution, this is a blockable staged executable payload carrier.