registry / Install hook abuse / @sciagent/cli
@sciagent/cli
SciAgent CLI - AI Research Assistant
This report shows the evidence for @sciagent/cli@1.3.73. 4 of 68 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package uses an automatic lifecycle hook to install external code globally and stage opaque remote executables for later execution without integrity verification. That is concrete install-hook abuse, even though the visible JavaScript does not harvest credentials.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm installation triggers postinstall; invoking sciagent launches the downloaded payload.
Impact
A remote server or globally installed dependency can supply code that executes with the installing user's privileges.
Mechanism
Lifecycle download, global package installation, and execution of remote binaries.
Attack narrative
The postinstall hook runs without a separate user command, downloads an executable to the user's SciAgent directory, and installs a separate global npm package. The downloaded payload is accepted based on size rather than a cryptographic integrity check. The command wrapper subsequently starts that downloaded binary and includes remote update logic, creating a supply-chain path from installation to execution outside the reviewed package.
AI rationale
This package uses an automatic lifecycle hook to install external code globally and stage opaque remote executables for later execution without integrity verification. That is concrete install-hook abuse, even though the visible JavaScript does not harvest credentials.
Evidence
package.jsonscripts/postinstall.jsbin/sciagent.js$HOME/.sciagent/bin/sciagent$HOME/.sciagent/bin/codebuddy-headlessglobal npm installation of @tencent-ai/codebuddy-code
Network endpoints2
jihulab.compx1-jcy.matpool.com:26597
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs a postinstall script automatically.
- Postinstall installs an unrelated global npm package without a version pin.
- Postinstall downloads large executable payloads into the user's SciAgent directory and marks them executable, with only a size check.
- The CLI later launches the downloaded binary and also supports background remote updates.
Evidence against
- No source code reads credential files or sends harvested environment data.
- The visible logic is a CLI bootstrapper rather than obfuscated data-stealing code.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/sciagent.jsView file
19L20: const { spawn, execSync } = require('child_process');
L21: const path = require('path');
High
Findings
11 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/sciagent.js
HighShellscripts/postinstall.js
HighSame File Env Network Executionbin/sciagent.js#virtual:normalized:round1
HighSandbox Evasion Gated Capabilityscripts/postinstall.js
HighInstall Named Payload Filescripts/postinstall.js
HighRuntime Package Installscripts/postinstall.js
HighSemantic Analysis Limitedbin/sciagent.js#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/postinstall.js
HighKnown Malware Source Similaritybin/sciagent.js
HighKnown Malware Source Fingerprint Signaturescripts/postinstall.js
Affected versions and remediation
This report applies to @sciagent/cli@1.3.73.
The versions list below shows the verdict for each recorded version.
- Avoid installing @sciagent/cli@1.3.73. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.