registry / @sciagent/cli-linux-x64 / 1.0.69

@sciagent/cli-linux-x64@1.0.69

SciAgent CLI binary for Linux x64

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Install-time execution is declared, but the executed script is outside this extracted package and cannot be inspected here. The package is a stub that claims installation downloads the executable, leaving the payload behavior unresolved.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

unverified install-time code or binary acquisition

Mechanism

postinstall invokes an external relative script for a deferred binary payload

Rationale

The package has an unresolved install-time payload path but no direct evidence of malicious behavior in its shipped files. Warn rather than block until the parent lifecycle script and resulting binary are reviewed.

Evidence

package.jsonbin/README.md

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

`package.json` runs `postinstall` via `node ../../scripts/chmod.js`.
`bin/README.md` says the actual binary is downloaded during installation.
The package contains no binary or referenced lifecycle-script source to verify.

Evidence against

No credential, environment, file-harvesting, exfiltration, shell, or network code is shipped.
No AI-agent control-surface mutation or destructive behavior is present in inspected files.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-21json

1{

2 "name": "@sciagent/cli-linux-x64",

3 "version": "1.0.69",

4 "description": "SciAgent CLI binary for Linux x64",

5 "os": ["linux"],

6 "cpu": ["x64"],

7 "files": [

8 "bin/",

9 "README.md"

10 ],

11 "scripts": {

12 "postinstall": "node ../../scripts/chmod.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 },

14 "author": "SciAgent Team",

15 "license": "MIT",

16 "repository": {

17 "type": "git",

18 "url": "https://gitee.com/garva/research-agent.git"

19 }

20}

21

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node ../../scripts/chmod.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ../../scripts/chmod.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present

LPM CLI

Source & flagged code

2 flagged

package.jsonView file

Lines 1-21json

1{

2 "name": "@sciagent/cli-linux-x64",

3 "version": "1.0.69",

4 "description": "SciAgent CLI binary for Linux x64",

5 "os": ["linux"],

6 "cpu": ["x64"],

7 "files": [

8 "bin/",

9 "README.md"

10 ],

11 "scripts": {

12 "postinstall": "node ../../scripts/chmod.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 },

14 "author": "SciAgent Team",

15 "license": "MIT",

16 "repository": {

17 "type": "git",

18 "url": "https://gitee.com/garva/research-agent.git"

19 }

20}

21