@provenly/cli@1.0.0

One or more suspicious static signals were detected.

npm postinstall

A release/asset compromise can execute arbitrary code as the installing user.

remote binary download and install-time execution

During postinstall, install.js requests the latest release metadata, follows asset URLs supplied by that response, saves the selected platform binary under bin/, marks it executable, then runs it with `version`. Checksum verification is optional and its checksum is fetched from the same mutable release source. This creates an unconsented install-time remote-code-execution path if the release or delivery path is compromised.

The package performs automatic execution of a mutable remote binary at install time, with optional same-origin checksum validation. That is a concrete install-time remote payload execution surface.