registry / Staged payload carrier / @sciagent/cli / 1.1.85

@sciagent/cli@1.1.85

SciAgent CLI - AI Research Assistant

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package is a remote binary bootstrapper with install-time global dependency installation and no artifact verification. Its risky behavior is package-aligned, but it remains an unresolved staged-payload capability rather than confirmed malware.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall; later execution of the sciagent command

Impact

A compromised or malicious configured release endpoint can supply code executed as the installing user.

Mechanism

remote binary staging, persistence, and execution

AI rationale

Evidence

package.jsonscripts/postinstall.jsbin/sciagent.js~/.sciagent/bin/sciagent~/.sciagent/bin/codebuddy-headless%LOCALAPPDATA%/sciagent/bin/sciagent.exe%LOCALAPPDATA%/sciagent/bin/codebuddy-headless.exe

Network endpoints4

jihulab.com/api/v4/projects/351778px1-jcy.matpool.com:26741pypi.org/pypi/codebuddy-agent-sdk/jsonmirrors.cloud.tencent.com/pypi

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs postinstall.
scripts/postinstall.js downloads unsigned platform binaries during install.
postinstall globally installs @tencent-ai/codebuddy-code as fallback.
bin/sciagent.js executes downloaded binary and performs background updates.
Downloads are persisted under ~/.sciagent/bin or LOCALAPPDATA/sciagent/bin.

Evidence against

No source reads user credentials, project files, or AI-agent configuration.
No observed exfiltration, destructive action, eval, or foreign agent-control writes.
Network paths are dedicated to declared SciAgent/CodeBuddy binary delivery.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 80.3 KB of source, external domains: files.pythonhosted.org, gitee.com, jihulab.com, mirrors.aliyun.com, mirrors.cloud.tencent.com, px1-jcy.matpool.com, pypi.org, pypi.tuna.tsinghua.edu.cn, sciagent.tech

Source & flagged code

7 flagged

package.jsonView file

Lines 1-35json

2 "name": "@sciagent/cli",

3 "version": "1.1.85",

4 "description": "SciAgent CLI - AI Research Assistant",

5 "main": "index.js",

6 "files": [

7 "bin/",

8 "scripts/",

9 "index.js"

10 ],

11 "bin": {

12 "sciagent": "bin/sciagent.js"

13 },

14 "scripts": {

15 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "optionalDependencies": {},

18 "keywords": [

19 "ai",

20 "research",

21 "agent",

22 "cli",

23 "codebuddy"

24 ],

25 "author": "SciAgent Team",

26 "license": "MIT",

27 "repository": {

28 "type": "git",

29 "url": "https://gitee.com/garva/research-agent.git"

30 },

31 "engines": {

32 "node": ">=16"

33 },

34 "os": [

35 "linux",

bin/sciagent.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * SciAgent CLI 薄壳脚本

5 * 自动识别平台并调用对应的预编译二进制文件

6 *

7 * 二进制查找策略：

8 * 1. %LOCALAPPDATA%\sciagent\bin\ (Windows) 或 ~/.sciagent/bin/ (Linux/Mac)

9 * - 带严格版本校验（.version文件必须匹配CURRENT_VERSION）

10 * - 版本不匹配时自动从 Release Server 下载正确版本

11 * 2. 本地开发目录（仅开发模式）

12 * 3. 未找到时自动从 Release Server 下载

13 *

14 * 注意：不再从npm optionalDependencies中查找二进制，因为：

15 * - npm缓存中的旧包可能包含旧版二进制

16 * - npm可能修改package.json版本号来匹配请求，但二进制文件仍是旧的

17 * - 超过250MB的包无法发布到npm

18 */

20const { spawn, execSync } = require('child_process');

21const path = require('path');

High

Child Process

Package source references child process execution.

bin/sciagent.jsView on unpkg · L19

22const fs = require('fs');

23const os = require('os');

24const https = require('https');

25const http = require('http');

27// 当前版本号 - 与 postinstall.js 和 package.json 保持同步

28const CURRENT_VERSION = '1.1.85';

30// Releases 下载源配置（优先级从高到低）

31// JihuLab 通用包仓库（国内 CDN，速度快）作为主源

32// sciagent.tech 自建服务器作为备用源

33const JIHULAB_PROJECT_ID = '351778';

34const JIHULAB_DEPLOY_TOKEN_USER = 'gitlab+deploy-token-15400';

35const JIHULAB_DEPLOY_TOKEN = 'gldt-5kp7mgt4ztyyBMx1Uvn6';

36const JIHULAB_BASE_URL = `https://jihulab.com/api/v4/projects/${JIHULAB_PROJECT_ID}/packages/generic/sciagent`;

37const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26741?token=BdZ2oxzimV';

39// Parse SELF_HOSTED_URL to separate base URL from query params (e.g. ?token=xxx)

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3/**

4 * SciAgent CLI postinstall 脚本

5 * 1. 自动检测并安装平台特定的二进制包

6 * 2. 自动下载 CodeBuddy SDK 二进制文件（使用国内镜像源）

7 */

9const { execSync } = require('child_process');

10const path = require('path');

11const fs = require('fs');

12const https = require('https');

13const http = require('http');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L8

14const os = require('os');

16// 平台和架构映射

17const PLATFORM_MAP = {

18 linux: 'linux',

19 darwin: 'darwin',

20 win32: 'win32'

21};

23const ARCH_MAP = {

24 x64: 'x64',

25 arm64: 'arm64',

26 amd64: 'x64'

27};

Lines 465-505javascript

465 timeout: 120000

466 });

467 }

468

469 if (fs.existsSync(targetPath)) {

470 const stats = fs.statSync(targetPath);

471 console.log(`✅ CodeBuddy SDK 安装成功！(PyPI wheel)`);

472 console.log(` 路径: ${targetPath}`);

473 console.log(` 大小: ${(stats.size / (1024 * 1024)).toFixed(1)} MB`);

474

475 try { fs.unlinkSync(wheelPath); fs.unlinkSync(scriptPath); fs.rmdirSync(tmpDir); } catch (e) {}

476 return true;

477 }

478 } catch (e) {

479 console.log(` ⚠️ PyPI 下载失败: ${e.message}`);

480 }

481 }

482

483 // 策略2: 从 npm 安装 @tencent-ai/codebuddy-code（全平台支持，国内可访问）

484 console.log(' 尝试从 npm 安装 @tencent-ai/codebuddy-code...');

485 try {

486 execSync('npm install -g @tencent-ai/codebuddy-code', {

487 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L485

488 timeout: 300000

489 });

490

491 // 查找 npm 安装的 codebuddy-headless.js

492 const npmRootResult = execSync('npm root -g', { encoding: 'utf8', timeout: 10000 }).trim();

493 const headlessJsPath = path.join(npmRootResult, '@tencent-ai', 'codebuddy-code', 'dist', 'codebuddy-headless.js');

494

495 if (fs.existsSync(headlessJsPath)) {

496 // 创建 wrapper 脚本，让 codebuddy-headless 可以被直接调用

497 const binDir = getCodebuddyBinDir();

498 fs.mkdirSync(binDir, { recursive: true });

499 const binaryName = BINARY_NAMES[platform] || 'codebuddy-headless';

500 const wrapperPath = path.join(binDir, binaryName);

501

502 if (platform === 'win32') {

503 // Windows: 创建 .cmd wrapper

504 const cmdPath = wrapperPath.replace(/\.(exe)?$/, '.cmd');

505 fs.writeFileSync(cmdPath, `@echo off\r\nnode "${headlessJsPath}" %*\r\n`);

Lines 587-627javascript

587 }

588 // 等待进程完全退出

589 let retries = 10;

590 while (retries-- > 0 && isSciAgentRunning()) {

591 const sleep = require('util').promisify(setTimeout);

592 sleep(500);

593 }

594 return !isSciAgentRunning();

595 } catch (e) {

596 return false;

597 }

598}

599

600/**

601 * 尝试将临时文件替换为目标二进制文件

602 * 返回: 'replaced' | 'locked' | 'error'

603 */

604function tryReplaceBinary(tempPath, targetPath, installDir, version, platform) {

605 try {

606 // 先尝试直接复制

607 if (process.platform === 'win32') {

608 // Windows: 使用 PowerShell Copy-Item

609 const tmpScript = path.join(os.tmpdir(), 'sciagent-replace.ps1');

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L607

610 const scriptContent = [

611 `Copy-Item -Path "${tempPath}" -Destination "${targetPath}" -Force`,

612 'if (Test-Path $out) { Write-Host "OK" } else { Write-Error "Copy failed"; exit 1 }'

613 ].join('\r\n');

614 fs.writeFileSync(tmpScript, scriptContent, 'utf8');

615 try {

616 execSync(`powershell -NoProfile -ExecutionPolicy Bypass -File "${tmpScript}"`, {

617 stdio: 'pipe',

618 timeout: 30000

619 });

620 } finally {

621 try { fs.unlinkSync(tmpScript); } catch (e) {}

622 }

623 } else {

624 fs.copyFileSync(tempPath, targetPath);

625 fs.chmodSync(targetPath, 0o755);

626 }

627

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/sciagent.jsView file

19L20: const { spawn, execSync } = require('child_process'); L21: const path = require('path');

High

Child Process

Package source references child process execution.

bin/sciagent.jsView on unpkg · L19

scripts/postinstall.jsView file

607if (process.platform === 'win32') { L608: // Windows: 使用 PowerShell Copy-Item L609: const tmpScript = path.join(os.tmpdir(), 'sciagent-replace.ps1');

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L607

8L9: const { execSync } = require('child_process'); L10: const path = require('path'); L11: const fs = require('fs'); L12: const https = require('https'); L13: const http = require('http'); ... L41: // 自建服务器配置（备用源） L42: const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26741?token=BdZ2oxzimV'; L43: ... L87: function getCodebuddyBinDir() { L88: const platform = process.platform; L89: if (platform === 'win32') {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L8

485try { L486: execSync('npm install -g @tencent-ai/codebuddy-code', { L487: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L485

Findings

6 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/sciagent.js

HighShellscripts/postinstall.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.js

HighInstall Named Payload Filescripts/postinstall.js

HighRuntime Package Installscripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @sciagent/cli@1.1.85.

See all versions of @sciagent/cli for other recorded verdicts.

Review the evidence and your use of @sciagent/cli@1.1.85 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-29 17:26:49.043Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.