registry  /  @sciagent/cli-linux-x64  /  1.0.51

@sciagent/cli-linux-x64@1.0.51

SciAgent CLI binary for Linux x64

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package invokes an external lifecycle script not shipped in this package. The package is a stub that declares its binary is downloaded during installation, but the downloader is not inspectable here.

Static reason
One or more suspicious static signals were detected.
Trigger
npm installation
Impact
Unverified external code may fetch and install a binary at install time.
Mechanism
postinstall execution of an external relative script
Rationale
The package is an install-time stub whose referenced external script and claimed binary download cannot be verified from its shipped source. The source does not establish a concrete malicious outcome, so a warning is more proportionate than a block.
Evidence
package.jsonbin/README.md../../scripts/chmod.js

Decision evidence

public snapshot
AI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • `package.json` defines a `postinstall` hook.
  • The hook runs `node ../../scripts/chmod.js`, outside this package directory.
  • `bin/README.md` says the actual binary is downloaded during installation.
  • The package contains no binary or downloader source to verify that install-time behavior.
Evidence against
  • Only `package.json` and `bin/README.md` are present.
  • No executable, native binary, credential harvesting, shell command, or network client exists in the package files.
  • No concrete endpoint or payload is included for direct inspection.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ../../scripts/chmod.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ../../scripts/chmod.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present