@onescience/onecode@1.14.50-202607021538

One or more suspicious static signals were detected.

npm install or package manager lifecycle script

A network or endpoint compromise can replace the installed onecode executable that users later run via the package bin.

postinstall remote tgz download, extraction, chmod, and launcher hardlink

On install, package.json invokes postinstall.mjs, which imports platform-bootstrap.mjs. If a platform binary is not already present, it downloads a tgz from a hardcoded IP endpoint with certificate validation disabled, extracts it, chmods the binary, links it into bin/.onecode, and refreshes bundled asset symlinks. The bin launcher later spawns that installed executable.

Source inspection confirms a lifecycle-triggered remote executable payload install from a non-registry IP endpoint with TLS verification disabled. Even without credential theft or immediate binary execution, this is a blockable staged payload carrier because the package installs unverified remote code during npm install.