Loading npm security reports…

@onescience/onecode@1.14.50-202609171732: Malicious npm security | LPM Firewall

registry / @onescience/onecode / 1.14.50-202609171732

@onescience/onecode@1.14.50-202609171732

OneScience AI coding agent for the terminal.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

On npm install, postinstall downloads an unverified native tarball from a raw IP over HTTPS with certificate checks turned off, extracts it, and installs an executable plus asset symlinks. The CLI launcher then runs that dropped binary.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install runs the postinstall script automatically.

Impact

arbitrary code execution as the installing user when the dropped binary is linked and later spawned

Mechanism

unverified remote native payload install via postinstall

Attack narrative

Installing this package runs postinstall.mjs, which calls ensurePlatformBinary. That function downloads a tarball from https://218.90.133.98:4443 with TLS certificate verification disabled, extracts it with tar, chmod 755 the binary, hardlinks it to bin/.onecode, and symlinks .opencode and .oneskills. There is no integrity check, no optionalDependencies fallback, and the URL always names a linux-x64 archive. bin/onecode then spawns that cached binary, so install time yields unconsented remote payload execution.

AI rationale

The postinstall hook downloads and installs an unverified native binary from a raw IP with TLS verification disabled, then the CLI launcher executes it. That is a concrete unconsented install-time remote payload chain, not package-aligned setup.

Evidence

package.jsonpostinstall.mjsplatform-bootstrap.mjsbin/onecodebin/.onecode.opencode.oneskills.platform-version

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10scripts.postinstall = node ./postinstall.mjs Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L10: import os from "os" L11: import https from "https" L12: import { fileURLToPath } from "url" ... L15: const product = "onecode" L16: const DEFAULT_TGZ_BASE = "https://218.90.133.98:4443/onecode_tgz" L17: ... L78: const binaryName = detectPlatformAndArch().platform === "windows" ? `${product}.exe` : product L79: const binaryPath = path.join(rootDir, "node_modules", packageName, "bin", binaryName) L80: if (!fs.existsSync(binaryPath)) return null L81: return { binaryPath, binaryName, packageName } L82: } ... L99: return new Promise((resolve, reject) => {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L10

10"scripts": { "postinstall": "node ./postinstall.mjs" }

High

Suspicious Lifecycle Evidence

package.json runs node ./postinstall.mjs automatically on npm install.

package.jsonView on unpkg · L10

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/onecodeView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202608281720 matchedPath = bin/onecode matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202608281720 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/onecodeView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 96df80412fc42a9f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @onescience/onecode@1.14.50-202608281720 matchedPath = bin/onecode matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202608281720 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/onecodeView on unpkg

platform-bootstrap.mjsView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202608281720 matchedPath = platform-bootstrap.mjs matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202608281720 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

platform-bootstrap.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-13json

1{

2 "name": "@onescience/onecode",

3 "version": "1.14.50-202609171732",

4 "private": false,

5 "license": "MIT",

6 "description": "OneScience AI coding agent for the terminal.",

7 "bin": {

8 "onecode": "./bin/onecode"

9 },

10 "scripts": {

11 "postinstall": "node ./postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 }

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L10

High

Suspicious Lifecycle Evidence

package.json runs node ./postinstall.mjs automatically on npm install.

package.jsonView on unpkg · L10

13}

bin/onecodeView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202608281720 matchedPath = bin/onecode matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202608281720 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/onecodeView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 96df80412fc42a9f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @onescience/onecode@1.14.50-202608281720 matchedPath = bin/onecode matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202608281720 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/onecodeView on unpkg

platform-bootstrap.mjsView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202608281720 matchedPath = platform-bootstrap.mjs matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202608281720 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

platform-bootstrap.mjsView on unpkg