registry  /  @sciagent/cli-darwin-arm64  /  1.0.0

@sciagent/cli-darwin-arm64@1.0.0

SciAgent CLI binary for macOS ARM64 (Apple Silicon)

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The only actionable surface in this package is an install-time postinstall command, but the referenced script is outside the package and no payload source is present here. No confirmed malicious behavior is established from the package files inspected.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install postinstall lifecycle
Impact
Unresolved install-time execution risk if a parent package supplies ../../scripts/chmod.js; no direct payload found in this package
Mechanism
external chmod helper reference
Rationale
Static inspection found only package.json and an install lifecycle script pointing outside the package; no source evidence of exfiltration, destructive behavior, persistence, or control-surface hijacking was present. Because install-time execution is real but the script body is absent from this package, this is unresolved risk rather than confirmed malware.
Evidence
package.json../../scripts/chmod.js

Decision evidence

public snapshot
AI called this Suspicious at 66.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • package.json defines a postinstall lifecycle script: node ../../scripts/chmod.js
  • postinstall references ../../scripts/chmod.js outside this package directory, so this package alone does not contain the script being executed
Evidence against
  • Package directory contains only package.json; declared bin/ and README.md files are absent in this extracted source
  • No package source files showing credential harvesting, exfiltration, persistence, destructive behavior, or AI-agent control-surface mutation were present
  • No runtime entrypoint, native binary, eval/vm usage, child_process code, or network endpoint was present in package files
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ../../scripts/chmod.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ../../scripts/chmod.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present