registry  /  @sciagent/cli-darwin-x64  /  1.0.33

@sciagent/cli-darwin-x64@1.0.33

SciAgent CLI binary for macOS x64 (Intel)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The package contents expose only a package.json with a postinstall hook pointing to a shared parent script. No concrete malicious payload or runtime attack behavior is present inside this package directory.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install postinstall lifecycle
Impact
Unresolved install-time risk is limited to an out-of-package helper path; no source evidence of exfiltration, persistence, destructive behavior, or control-surface mutation was found in this package.
Mechanism
external chmod helper invocation declared in manifest
Rationale
A lifecycle hook is real unresolved install-time risk, but the inspected package contains no executable payload or concrete malicious behavior beyond a parent chmod helper reference. This supports a warning rather than a publish block.
Evidence
package.json../../scripts/chmod.js
Network endpoints1
gitee.com/garva/research-agent.git

Decision evidence

public snapshot
AI called this Suspicious at 74.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • package.json defines install-time postinstall: node ../../scripts/chmod.js
  • postinstall target is outside this extracted package directory, so its behavior is not represented in package contents
Evidence against
  • Read-only file listing found only package.json in the package root
  • No bin/, README.md, main/module/browser entrypoint, source files, native binary, or payload files were present to execute or load
  • package.json has no dependency list, no network code, no credential/file harvesting code, and no AI-agent control-surface paths
  • Repository URL is metadata only: https://gitee.com/garva/research-agent.git
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ../../scripts/chmod.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ../../scripts/chmod.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present