@onescience/onecode@1.14.50-202609221556: Suspicious npm security | LPM Firewall

Loading npm security reports…

@onescience/onecode@1.14.50-202609221556: Suspicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

10scripts.postinstall = node ./postinstall.mjs Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L10: import os from "os" L11: import https from "https" L12: import { fileURLToPath } from "url" ... L15: const product = "onecode" L16: const DEFAULT_TGZ_BASE = "https://218.90.133.98:4443/onecode_tgz" L17: ... L78: const binaryName = detectPlatformAndArch().platform === "windows" ? `${product}.exe` : product L79: const binaryPath = path.join(rootDir, "node_modules", packageName, "bin", binaryName) L80: if (!fs.existsSync(binaryPath)) return null L81: return { binaryPath, binaryName, packageName } L82: } ... L99: return new Promise((resolve, reject) => {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L10

•scripts.postinstall = node ./postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

10"scripts": { "postinstall": "node ./postinstall.mjs" }

Medium

Suspicious Lifecycle Evidence

The package runs postinstall automatically.

package.jsonView on unpkg · L10

bin/onecodeView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202609220941 matchedPath = bin/onecode matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202609220941 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/onecodeView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 96df80412fc42a9f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @onescience/onecode@1.14.50-202609220941 matchedPath = bin/onecode matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202609220941 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/onecodeView on unpkg

platform-bootstrap.mjsView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202609220941 matchedPath = platform-bootstrap.mjs matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202609220941 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

platform-bootstrap.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-13json

1{

2 "name": "@onescience/onecode",

3 "version": "1.14.50-202609221556",

4 "private": false,

5 "license": "MIT",

6 "description": "OneScience AI coding agent for the terminal.",

7 "bin": {

8 "onecode": "./bin/onecode"

9 },

10 "scripts": {

11 "postinstall": "node ./postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 }

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L10

Medium

Suspicious Lifecycle Evidence

The package runs postinstall automatically.

package.jsonView on unpkg · L10

13}

bin/onecodeView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202609220941 matchedPath = bin/onecode matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202609220941 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/onecodeView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 96df80412fc42a9f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @onescience/onecode@1.14.50-202609220941 matchedPath = bin/onecode matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202609220941 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/onecodeView on unpkg

platform-bootstrap.mjsView file

•matchType = normalized_sha256 matchedPackage = @onescience/onecode@1.14.50-202609220941 matchedPath = platform-bootstrap.mjs matchedIdentity = npm:QG9uZXNjaWVuY2Uvb25lY29kZQ:1.14.50-202609220941 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

platform-bootstrap.mjsView on unpkg