registry / @sciagent/cli / 1.2.7

@sciagent/cli@1.2.7

SciAgent CLI - AI Research Assistant

AI Security Review

scanned 21d ago · by lpm-firewall-ai

npm postinstall fetches unverified executable payloads and writes them to the user's SciAgent directory. The CLI subsequently launches and auto-updates those payloads.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation; later `sciagent` invocation

Impact

A compromised or substituted download source can supply code executed as the installing user.

Mechanism

install-time remote binary staging and runtime execution

Rationale

The package is an unsigned remote binary bootstrapper with install-time side effects and runtime execution of fetched payloads. This warrants a warning, but source inspection does not establish malicious intent or a block-level foreign agent-control mutation.

Evidence

package.jsonscripts/postinstall.jsbin/sciagent.js~/.sciagent/bin/sciagent~/.sciagent/bin/codebuddy-headless~/.sciagent/bin/.version~/.sciagent/bin/.pending-update

Network endpoints6

jihulab.compx1-jcy.matpool.com:26741pypi.orgmirrors.cloud.tencent.commirrors.aliyun.compypi.tuna.tsinghua.edu.cn

@sciagent/cli@1.2.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code