registry  /  @sciagent/cli-linux-arm64  /  1.0.0

@sciagent/cli-linux-arm64@1.0.0

SciAgent CLI binary for Linux ARM64

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The only active behavior is an npm postinstall hook that attempts to run a JavaScript file outside this package. The referenced script is not included in the extracted package, so no concrete malicious payload is confirmed.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install lifecycle postinstall
Impact
Potential execution of an external ../../scripts/chmod.js if present in the install layout; otherwise likely install failure or no useful package behavior.
Mechanism
out-of-package lifecycle script execution attempt
Rationale
Source inspection found a suspicious install hook escaping the package boundary, but no packaged payload or concrete attack chain. This supports a warning rather than a publish block.
Evidence
package.json../../scripts/chmod.js

Decision evidence

public snapshot
AI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • package.json defines postinstall: node ../../scripts/chmod.js
  • postinstall path escapes the package directory and targets ../../scripts/chmod.js
  • Manifest files list bin/ and README.md, but extracted package contains only package.json
Evidence against
  • No packaged JavaScript payload beyond package.json was present to inspect
  • No bin, main, module, or browser entrypoint exists in the extracted package
  • No credential harvesting, network runtime code, AI-agent config writes, persistence, or destructive code was found
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ../../scripts/chmod.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ../../scripts/chmod.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present