Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@onescience/onecode@1.14.50-202608061459: Suspicious npm security | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 9 finding(s) warrant review before installing.

View on npm All versions

registry / @onescience/onecode / 1.14.50-202608061459

@onescience/onecode@1.14.50-202608061459

OneScience AI coding agent for the terminal.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

npm install fetches an unverified native archive from a fixed external IP with TLS certificate validation disabled. The package installs and exposes that archive's binary for execution when the onecode CLI is run.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install, followed by invoking onecode

Impact

A network attacker or remote host operator can replace the native executable users later run.

Mechanism

postinstall remote native-payload download, extraction, and launcher linking

Rationale

The source establishes a real unverified remote-native-payload delivery path, but the extracted payload is unavailable here, so concrete malicious behavior beyond that delivery mechanism cannot be established.

Evidence

package.jsonpostinstall.mjsplatform-bootstrap.mjsbin/onecodebin/.onecodenode_modules/onecode-<platform>-<arch>.platform-bootstrap-work.platform-version.opencode.oneskills

Network endpoints1

218.90.133.98:4443/onecode_tgz

OSV Corroboration

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

OpenSSF/OSV

Advisory

MAL-2026-10717

Source

OpenSSF Malicious Packages via OSV

Summary

The source establishes a real unverified remote-native-payload delivery path, but the extracted payload is unavailable here, so concrete malicious behavior beyond that delivery mechanism cannot be established.

References

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

package.json runs postinstall.mjs on npm install.
platform-bootstrap.mjs downloads an archive from 218.90.133.98:4443 during postinstall.
Download disables TLS verification and accepts redirects without integrity verification.
Downloaded archive is extracted and its native binary is installed, linked, and later launched by bin/onecode.

Evidence against

No credential harvesting or outbound data-exfiltration code found.
No source evidence of destructive actions or writes outside this package installation.
Agent-related directories are linked under the package root, not a foreign user control surface.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 8.91 KB of source, external domains: 218.90.133.98

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10scripts.postinstall = node ./postinstall.mjs Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L10: import os from "os" L11: import https from "https" L12: import { fileURLToPath } from "url" ... L15: const product = "onecode" L16: const DEFAULT_TGZ_BASE = "https://218.90.133.98:4443/onecode_tgz" L17: ... L78: const binaryName = detectPlatformAndArch().platform === "windows" ? `${product}.exe` : product L79: const binaryPath = path.join(rootDir, "node_modules", packageName, "bin", binaryName) L80: if (!fs.existsSync(binaryPath)) return null L81: return { binaryPath, binaryName, packageName } L82: } ... L99: return new Promise((resolve, reject) => {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L10

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

platform-bootstrap.mjsView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202607281613 matchedPath = platform-bootstrap.mjs matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202607281613 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

platform-bootstrap.mjsView on unpkg

Findings

3 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighUnverified Remote Native Payload Installpackage.json

HighKnown Malware Source Similarityplatform-bootstrap.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

96%Warn

Verdict confidence

IntentCritical Vulnerability

TypeStaged Payload Carrier

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Maintainersonescience

Version1.14.50-202608191048

PublishedAug 6, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size5.34 KB

Files5

Runtime surface

package.json

Entrypointsbin → onecode

RuntimeNo engine / OS / CPU constraints

Artifact15.6 KB · 5 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkShellUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

package.jsonView file

Lines 1-13json

1{

2 "name": "@onescience/onecode",

3 "version": "1.14.50-202608061459",

4 "private": false,

5 "license": "MIT",

6 "description": "OneScience AI coding agent for the terminal.",

7 "bin": {

8 "onecode": "./bin/onecode"

9 },

10 "scripts": {

11 "postinstall": "node ./postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 }

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L10

13}

platform-bootstrap.mjsView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202607281613 matchedPath = platform-bootstrap.mjs matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202607281613 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

platform-bootstrap.mjsView on unpkg