registry / @onescience/onecode / 1.14.50-202607281613

@onescience/onecode@1.14.50-202607281613

OneScience AI coding agent for the terminal.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

npm postinstall fetches an unauthenticated platform archive from a fixed IP with TLS verification disabled. It extracts the archive into node_modules and configures its binary to run when the CLI is invoked.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing @onescience/onecode; invoking onecode executes the staged binary.

Impact

The endpoint can supply an arbitrary executable that will run as the installing user on later CLI use.

Mechanism

postinstall remote binary download, extraction, and launcher linkage

Attack narrative

The postinstall hook downloads a platform tgz from a hard-coded IP address while explicitly disabling TLS certificate verification. It neither pins nor verifies the archive, extracts it into node_modules, and links its executable into bin/.onecode. The CLI launcher then spawns that executable, allowing the remote server to stage arbitrary native code for execution.

Rationale

This is a concrete unverified remote payload chain activated by npm postinstall, not merely a normal packaged optional dependency. The fixed IP endpoint and disabled TLS validation make the staged executable attacker-controlled if the endpoint or connection is compromised.

Evidence

package.jsonpostinstall.mjsplatform-bootstrap.mjsbin/onecodenode_modules/onecode-linux-x64/bin/.onecode.platform-version.platform-bootstrap-work

The npm postinstall hook runs ensurePlatformBinary(), which downloads a.tgz archive from the hardcoded bare-IP URL https://218.90.133.98:4443/onecode_tgz/onecode-<ver>/onecode-linux-x64-<ver>.tgz, extracts it via `tar -xzf`, chmods the extracted file to 0o755, hardlinks it into bin/.onecode, and the shipped CLI launcher invokes it. The HTTPS request explicitly sets `rejectUnauthorized: false`, disabling TLS certificate verification, and no hash or signature check is performed on the downloaded artifact. The download destination is a bare IPv4 address on a non-standard port, not a publisher-owned domain or a recognized release host. The package name and launcher (@onescience/onecode) mirror the unrelated 'opencode' project — env-var fallbacks reference OPENCODE_BIN_PATH and bundled asset directories are named.opencode/session-seed and.opencode/oneskills — while the executable payload is retrieved from an unrelated hardcoded IP endpoint. Anyone controlling that host, or any on-path network attacker (TLS is disabled), can deliver arbitrary code that executes on every installer's machine.

@onescience/onecode@1.14.50-202607281613

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code