@sciagent/cli@1.1.31
SciAgent CLI - AI Research Assistant
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete install-time remote-payload bootstrap chain with no artifact-integrity verification, but the inspected source does not establish data theft, stealth, or a foreign AI-agent control-surface mutation. It warrants a warning rather than a malicious block under the stated boundary.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall; later invocation of the sciagent command.
Impact
A compromised package registry, mirror, release server, or redirected download can supply executable code to the user.
Mechanism
remote binary download, installation, and execution bootstrapper
AI rationale
This is a concrete install-time remote-payload bootstrap chain with no artifact-integrity verification, but the inspected source does not establish data theft, stealth, or a foreign AI-agent control-surface mutation. It warrants a warning rather than a malicious block under the stated boundary.
Evidence
package.jsonscripts/postinstall.jsbin/sciagent.js~/.sciagent/bin/sciagent~/.sciagent/bin/codebuddy-headless~/.sciagent/bin/.version~/.sciagent/bin/.pending-update
Network endpoints6
jihulab.comu250924-a969-d9c894d0.westb.seetacloud.commirrors.cloud.tencent.commirrors.aliyun.compypi.tuna.tsinghua.edu.cnpypi.org
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json runs scripts/postinstall.js automatically.
- postinstall downloads unsigned platform binaries into ~/.sciagent/bin.
- postinstall fetches latest CodeBuddy wheel metadata and extracts its binary.
- Fallback runs `npm install -g @tencent-ai/codebuddy-code` during install.
- bin/sciagent.js later executes the downloaded sciagent binary and auto-updates it.
Evidence against
- No credential harvesting or outbound local-data upload found.
- No AI-agent configuration/control-surface writes found.
- Shell commands are limited to download, extraction, process, and binary-management tasks.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/sciagent.jsView file
19L20: const { spawn, execSync } = require('child_process');
L21: const path = require('path');
High
Findings
5 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/sciagent.js
HighShellscripts/postinstall.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.js
HighRuntime Package Installscripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sciagent/cli@1.1.31.
See all versions of @sciagent/cli for other recorded verdicts.
- Review the evidence and your use of @sciagent/cli@1.1.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.