@sciagent/cli@1.0.54
SciAgent CLI - AI Research Assistant
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is not proven intentionally malicious, but its automatic unsigned remote payload staging and runtime execution create a severe unresolved supply-chain execution path. Warn rather than block because writes are package-owned and no concrete theft, destructive action, or foreign control-surface mutation was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
`npm install` runs postinstall; invoking `sciagent` launches the staged binary.
Impact
A compromised or substituted release, PyPI mirror, GitHub asset, or globally installed fallback package can execute code as the installing user when the CLI runs.
Mechanism
Unsigned remote binary/wheel download, extraction, persistence, and later execution.
AI rationale
The package is not proven intentionally malicious, but its automatic unsigned remote payload staging and runtime execution create a severe unresolved supply-chain execution path. Warn rather than block because writes are package-owned and no concrete theft, destructive action, or foreign control-surface mutation was found.
Evidence
package.jsonscripts/postinstall.jsbin/sciagent.jsscripts/chmod.js~/.sciagent/bin%LOCALAPPDATA%\sciagent\bin
Network endpoints4
u250924-adc6-f977430f.westb.seetacloud.com:8443api.github.com/repos/poisondrinker/research-agent/releasesmirrors.cloud.tencent.com/pypi/pypi/codebuddy-agent-sdk/jsonpypi.org/pypi/codebuddy-agent-sdk/json
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- `scripts/postinstall.js` runs automatically via `postinstall`.
- It downloads platform binaries to `~/.sciagent/bin` from a private release server and GitHub.
- Downloaded SciAgent binaries have no checksum or signature verification.
- It downloads/extracts a CodeBuddy wheel and falls back to global `npm install -g @tencent-ai/codebuddy-code`.
- `bin/sciagent.js` later executes the staged binary with `spawn()`.
- Postinstall writes executable wrappers and changes executable permissions.
Evidence against
- No credential, token, shell-history, or broad home-directory harvesting was found.
- No source writes AI-agent configuration or modifies foreign agent control surfaces.
- The launcher forwards user CLI arguments to the package-owned binary path; no hidden shell command was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/sciagent.jsView file
7L8: const { spawn } = require('child_process');
L9: const path = require('path');
High
Findings
1 Critical4 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltascripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/sciagent.js
HighShell
HighRuntime Package Installscripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sciagent/cli@1.0.54.
See all versions of @sciagent/cli for other recorded verdicts.
- Review the evidence and your use of @sciagent/cli@1.0.54 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.