@sciagent/cli@1.1.52
SciAgent CLI - AI Research Assistant
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete unsigned remote-payload bootstrapper with install-time persistence and later execution, but the inspected source shows no hidden execution during install, data theft, or foreign AI-agent control-surface mutation. Treat as a risky staged payload carrier rather than confirmed malware.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall; later invocation of the sciagent command
Impact
A compromised release/mirror endpoint can supply an executable payload that is persisted and run.
Mechanism
remote binary download, persistence, and user-invoked execution
AI rationale
This is a concrete unsigned remote-payload bootstrapper with install-time persistence and later execution, but the inspected source shows no hidden execution during install, data theft, or foreign AI-agent control-surface mutation. Treat as a risky staged payload carrier rather than confirmed malware.
Evidence
package.jsonscripts/postinstall.jsbin/sciagent.js~/.sciagent/bin/sciagent~/.sciagent/bin/codebuddy-headless~/.sciagent/bin/.version~/.sciagent/bin/.pending-update
Network endpoints3
jihulab.com/api/v4/projects/351778/packages/generic/sciagentsciagent.techpypi.org/pypi/codebuddy-agent-sdk/json
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json runs scripts/postinstall.js automatically.
- postinstall downloads unsigned platform executables and stores them under ~/.sciagent/bin.
- postinstall installs @tencent-ai/codebuddy-code globally as a fallback.
- bin/sciagent.js downloads, chmods, and executes the fetched sciagent binary.
- Only a 10 MB size check is performed; no hash or signature verification.
Evidence against
- No credential/file harvesting or exfiltration code found.
- No AI-agent config/control-surface writes found.
- Downloaded sciagent binary is launched through the explicit sciagent CLI command, not during postinstall.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/sciagent.jsView file
19L20: const { spawn, execSync } = require('child_process');
L21: const path = require('path');
High
Findings
6 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/sciagent.js
HighShellscripts/postinstall.js
HighSandbox Evasion Gated Capabilityscripts/postinstall.js
HighInstall Named Payload Filescripts/postinstall.js
HighRuntime Package Installscripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @sciagent/cli@1.1.52.
See all versions of @sciagent/cli for other recorded verdicts.
- Review the evidence and your use of @sciagent/cli@1.1.52 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.