@sciagent/cli@1.3.55: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@sciagent/cli@1.3.55: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/sciagent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sciagent/cli@1.3.54 matchedIdentity = npm:QHNjaWFnZW50L2NsaQ:1.3.54 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/sciagent.jsView on unpkg

19L20: const { spawn, execSync } = require('child_process'); L21: const path = require('path');

High

Child Process

Package source references child process execution.

bin/sciagent.jsView on unpkg · L19

scripts/postinstall.jsView file

685if (process.platform === 'win32') { L686: // Windows: 使用 PowerShell Copy-Item L687: const tmpScript = path.join(os.tmpdir(), 'sciagent-replace.ps1');

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L685

8L9: const { execSync } = require('child_process'); L10: const path = require('path'); L11: const fs = require('fs'); L12: const https = require('https'); L13: const http = require('http'); ... L41: // 自建服务器配置（备用源） L42: const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26741?token=BdZ2oxzimV'; L43: ... L87: function getCodebuddyBinDir() { L88: const platform = process.platform; L89: if (platform === 'win32') {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

8L9: const { execSync } = require('child_process'); L10: const path = require('path'); L11: const fs = require('fs'); L12: const https = require('https'); L13: const http = require('http'); ... L41: // 自建服务器配置（备用源） L42: const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26741?token=BdZ2oxzimV'; L43: ... L87: function getCodebuddyBinDir() { L88: const platform = process.platform; L89: if (platform === 'win32') {

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.js

Lines 535-575javascript

535 console.log(` ⚠️ 提取的 SDK 二进制校验失败: ${check.desc}`);

536 try { fs.unlinkSync(targetPath); } catch (e) {}

537 try { fs.unlinkSync(wheelPath); fs.unlinkSync(scriptPath); fs.rmdirSync(tmpDir); } catch (e) {}

538 throw new Error(`SDK 二进制校验失败: ${check.desc}`);

539 }

540 console.log(`✅ CodeBuddy SDK 安装成功！(PyPI wheel)`);

541 console.log(` 路径: ${targetPath}`);

542 console.log(` 大小: ${(stats.size / (1024 * 1024)).toFixed(1)} MB`);

543 console.log(` 架构: ${check.desc}`);

544

545 try { fs.unlinkSync(wheelPath); fs.unlinkSync(scriptPath); fs.rmdirSync(tmpDir); } catch (e) {}

546 return true;

547 }

548 } catch (e) {

549 console.log(` ⚠️ PyPI 下载失败: ${e.message}`);

550 }

551 }

552

553 // 策略2: 从 npm 安装 @tencent-ai/codebuddy-code（全平台支持，国内可访问）

554 console.log(' 尝试从 npm 安装 @tencent-ai/codebuddy-code...');

555 try {

556 execSync('npm install -g @tencent-ai/codebuddy-code', {

557 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L555

558 timeout: 300000

559 });

560

561 // 查找 npm 安装的 codebuddy-headless.js

562 const npmRootResult = execSync('npm root -g', { encoding: 'utf8', timeout: 10000 }).trim();

563 const headlessJsPath = path.join(npmRootResult, '@tencent-ai', 'codebuddy-code', 'dist', 'codebuddy-headless.js');

564

565 if (fs.existsSync(headlessJsPath)) {

566 // 创建 wrapper 脚本，让 codebuddy-headless 可以被直接调用

567 const binDir = getCodebuddyBinDir();

568 fs.mkdirSync(binDir, { recursive: true });

569 const binaryName = BINARY_NAMES[platform] || 'codebuddy-headless';

570 const wrapperPath = path.join(binDir, binaryName);

571

572 if (platform === 'win32') {

573 // Windows: 创建 .cmd wrapper

574 const cmdPath = wrapperPath.replace(/\.(exe)?$/, '.cmd');

575 fs.writeFileSync(cmdPath, `@echo off\r\nnode "${headlessJsPath}" %*\r\n`);