@sciagent/cli@1.3.61

One or more suspicious static signals were detected.

npm postinstall; later explicit sciagent invocation

Remote server or package-manager content can achieve arbitrary code execution as the installing user.

unverified remote binary download, staging, and execution

The postinstall hook downloads executable SciAgent and CodeBuddy payloads from remote mirrors into the user profile, marks them executable, and accepts them based mainly on size. The CLI wrapper subsequently launches the SciAgent binary; its update path fetches and applies further remote binaries. No cryptographic integrity or signature verification protects these payloads, so compromise or substitution of a configured source becomes code execution during installation or later use.

This package performs unconsented install-time staging of unverified remote executables and establishes a later execution/update chain. That is a concrete remote-payload execution risk, not merely a benign network primitive.