registry  /  @sciagent/cli-darwin-x64  /  1.0.0

@sciagent/cli-darwin-x64@1.0.0

SciAgent CLI binary for macOS x64 (Intel)

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The package has an install hook that attempts to execute a relative script outside the package. The referenced script is not present in the inspected package, so no concrete payload or confirmed malicious behavior is established.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install postinstall
Impact
Could execute an out-of-package chmod helper if present in the install layout; otherwise likely fails or no-ops depending on environment.
Mechanism
external relative Node script execution
Rationale
This is suspicious because the install hook reaches outside the package and the expected payload files are absent. It is not source-proven malicious because the inspected package contains no executable payload, network code, credential access, or confirmed mutation target.
Evidence
package.json../../scripts/chmod.js

Decision evidence

public snapshot
AI called this Suspicious at 74.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • package.json defines install-time postinstall: node ../../scripts/chmod.js
  • postinstall target uses ../../ path outside this package directory
  • Declared files include bin/ and README.md, but extracted package contains only package.json
Evidence against
  • No package source files contain credential harvesting, exfiltration, eval, shell wrappers, or network client code
  • No bundled binary or payload is present in the extracted package
  • Only URL observed is repository metadata in package.json
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ../../scripts/chmod.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ../../scripts/chmod.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present