registry  /  @sciagent/cli-linux-x64  /  1.0.58

@sciagent/cli-linux-x64@1.0.58

SciAgent CLI binary for Linux x64

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Installation invokes an external lifecycle script not included in this package. The package declares that a binary is downloaded during installation, but the downloader and payload are absent from the inspected archive.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install
Impact
Uninspectable install-time code may download or modify files; no concrete malicious action is established from this package alone.
Mechanism
postinstall delegation to an out-of-package script
Rationale
The install-time behavior is delegated outside the package and the claimed downloaded binary is absent, creating unresolved supply-chain risk. Static inspection does not establish a concrete malicious chain.
Evidence
package.jsonbin/README.md

Decision evidence

public snapshot
AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • `package.json` defines `postinstall: node ../../scripts/chmod.js`.
  • The lifecycle target is outside this package directory.
  • `bin/README.md` says the actual binary is downloaded during installation.
  • The archive contains no binary or downloader source to inspect.
Evidence against
  • Only `package.json` and `bin/README.md` are present.
  • No package-contained network endpoint, credential access, shell execution, or AI-agent config mutation was found.
  • No concrete malicious payload or exfiltration logic is present in inspected files.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ../../scripts/chmod.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ../../scripts/chmod.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present