registry / Staged payload carrier / @sciagent/cli / 1.1.34

@sciagent/cli@1.1.34

SciAgent CLI - AI Research Assistant

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The install hook creates a concrete unverified remote-code supply-chain surface, but inspected source does not show confirmed malicious behavior or foreign AI-agent control-surface mutation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation; later invocation of sciagent

Impact

A compromised configured release, package registry, or mirror can supply code executed as the installing user.

Mechanism

unverified remote binary staging and execution

AI rationale

The install hook creates a concrete unverified remote-code supply-chain surface, but inspected source does not show confirmed malicious behavior or foreign AI-agent control-surface mutation.

Evidence

package.jsonscripts/postinstall.jsbin/sciagent.jsscripts/chmod.js~/.sciagent/bin/sciagent~/.sciagent/bin/codebuddy-headless%LOCALAPPDATA%\sciagent\bin\sciagent.exe%LOCALAPPDATA%\sciagent\bin\codebuddy-headless.exe

Network endpoints6

jihulab.comu250924-a969-d9c894d0.westb.seetacloud.com:8443mirrors.cloud.tencent.commirrors.aliyun.compypi.tuna.tsinghua.edu.cnpypi.org

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs postinstall.
scripts/postinstall.js downloads unsigned platform binaries during install.
Postinstall writes executables under ~/.sciagent/bin or %LOCALAPPDATA%\sciagent\bin.
Postinstall falls back to global npm install of @tencent-ai/codebuddy-code.
bin/sciagent.js later executes the downloaded binary and auto-updates it.
No hash, signature, or provenance verification is implemented.

Evidence against

No credential or environment harvesting found beyond LOCALAPPDATA.
No exfiltration, AI-agent configuration writes, or broad filesystem targeting found.
Shell/process use is tied to downloading, extracting, and launching the package binary.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/sciagent.jsView file

19L20: const { spawn, execSync } = require('child_process'); L21: const path = require('path');

High

Child Process

Package source references child process execution.

bin/sciagent.jsView on unpkg · L19

scripts/postinstall.jsView file

583if (process.platform === 'win32') { L584: // Windows: 使用 PowerShell Copy-Item L585: const tmpScript = path.join(os.tmpdir(), 'sciagent-replace.ps1');

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L583

8L9: const { execSync } = require('child_process'); L10: const path = require('path'); L11: const fs = require('fs'); L12: const https = require('https'); L13: const http = require('http'); ... L36: // 优先使用环境变量，否则使用默认服务器 L37: const RELEASE_SERVER_URL = process.env.RELEASE_SERVER_URL || L38: 'https://u250924-a969-d9c894d0.westb.seetacloud.com:8443'; ... L72: function getCodebuddyBinDir() { L73: const platform = process.platform; L74: if (platform === 'win32') {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

454try { L455: execSync('npm install -g @tencent-ai/codebuddy-code', { L456: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L454

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/sciagent.jsView file

19L20: const { spawn, execSync } = require('child_process'); L21: const path = require('path');

High

Child Process

Package source references child process execution.

bin/sciagent.jsView on unpkg · L19

Findings

5 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/sciagent.js

HighShellscripts/postinstall.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.js

HighRuntime Package Installscripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @sciagent/cli@1.1.34.

See all versions of @sciagent/cli for other recorded verdicts.

Review the evidence and your use of @sciagent/cli@1.1.34 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-23 15:10:10.832Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.