@sciagent/cli@1.3.64: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@sciagent/cli@1.3.64: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/sciagent.jsView file

19L20: const { spawn, execSync } = require('child_process'); L21: const path = require('path');

High

Child Process

Package source references child process execution.

bin/sciagent.jsView on unpkg · L19

scripts/postinstall.jsView file

685if (process.platform === 'win32') { L686: // Windows: 使用 PowerShell Copy-Item L687: // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK 解码，

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L685

8L9: const { execSync } = require('child_process'); L10: const path = require('path'); L11: const fs = require('fs'); L12: const https = require('https'); L13: const http = require('http'); ... L41: // 自建服务器配置（备用源） L42: const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26741?token=BdZ2oxzimV'; L43: ... L87: function getCodebuddyBinDir() { L88: const platform = process.platform; L89: if (platform === 'win32') {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

8L9: const { execSync } = require('child_process'); L10: const path = require('path'); L11: const fs = require('fs'); L12: const https = require('https'); L13: const http = require('http'); ... L41: // 自建服务器配置（备用源） L42: const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26741?token=BdZ2oxzimV'; L43: ... L87: function getCodebuddyBinDir() { L88: const platform = process.platform; L89: if (platform === 'win32') {

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L8

555

bin/sciagent.js#virtual:normalized:round1View file

121if (process.platform === "win32") { L122: // Windows: 使用 PowerShell L123: // 注意：脚本必须以 UTF-8 BOM 写入——PowerShell 5.1 对无 BOM 的 ... L126: const logFile = path.join(installDir, "update-apply.log"); L127: const esc = (s) => String(s).replace(/"/g, \"""\");\r\n const scriptContent = [\r\n `$ErrorActionPreference = "Stop"`,\r\n `$log = "${esc(logFile)}"`,\r\n ... L128: // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/sciagent.js#virtual:normalized:round1View on unpkg · L121

Source & flagged code

8 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "@sciagent/cli",

3 "version": "1.3.64",

4 "description": "SciAgent CLI - AI Research Assistant",

5 "main": "index.js",

6 "files": [

7 "bin/",

8 "scripts/",

9 "index.js"

10 ],

11 "bin": {

12 "sciagent": "bin/sciagent.js"

13 },

14 "scripts": {

15 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "optionalDependencies": {},

18 "keywords": [

19 "ai",

20 "research",

21 "agent",

22 "cli",

23 "codebuddy"

24 ],

25 "author": "SciAgent Team",

26 "license": "MIT",

27 "repository": {

28 "type": "git",

29 "url": "https://gitee.com/garva/research-agent.git"

30 },

31 "engines": {

32 "node": ">=16"

33 },

34 "os": [

35 "linux",

bin/sciagent.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2

3/**

4 * SciAgent CLI 薄壳脚本

5 * 自动识别平台并调用对应的预编译二进制文件

6 *

7 * 二进制查找策略：

8 * 1. %LOCALAPPDATA%\sciagent\bin\ (Windows) 或 ~/.sciagent/bin/ (Linux/Mac)

9 * - 带严格版本校验（.version文件必须匹配CURRENT_VERSION）

10 * - 版本不匹配时自动从 Release Server 下载正确版本

11 * 2. 本地开发目录（仅开发模式）

12

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2

3/**

4 * SciAgent CLI postinstall 脚本

5 * 1. 自动检测并安装平台特定的二进制包

6 * 2. 自动下载 CodeBuddy SDK 二进制文件（使用国内镜像源）

7 */

8

9const { execSync } = require('child_process');

bin/sciagent.js#virtual:normalized:round1View file

121if (process.platform === "win32") { L122: // Windows: 使用 PowerShell L123: // 注意：脚本必须以 UTF-8 BOM 写入——PowerShell 5.1 对无 BOM 的 ... L126: const logFile = path.join(installDir, "update-apply.log"); L127: const esc = (s) => String(s).replace(/"/g, \"""\");\r\n const scriptContent = [\r\n `$ErrorActionPreference = "Stop"`,\r\n `$log = "${esc(logFile)}"`,\r\n ... L128: // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/sciagent.js#virtual:normalized:round1View on unpkg · L121

Lines 535-575javascript

535 console.log(` ⚠️ 提取的 SDK 二进制校验失败: ${check.desc}`);

536 try { fs.unlinkSync(targetPath); } catch (e) {}

537 try { fs.unlinkSync(wheelPath); fs.unlinkSync(scriptPath); fs.rmdirSync(tmpDir); } catch (e) {}

538 throw new Error(`SDK 二进制校验失败: ${check.desc}`);

539 }

540 console.log(`✅ CodeBuddy SDK 安装成功！(PyPI wheel)`);

541 console.log(` 路径: ${targetPath}`);

542 console.log(` 大小: ${(stats.size / (1024 * 1024)).toFixed(1)} MB`);

543 console.log(` 架构: ${check.desc}`);

544

545 try { fs.unlinkSync(wheelPath); fs.unlinkSync(scriptPath); fs.rmdirSync(tmpDir); } catch (e) {}

546 return true;

547 }

548 } catch (e) {

549 console.log(` ⚠️ PyPI 下载失败: ${e.message}`);

550 }

551 }

552

553 // 策略2: 从 npm 安装 @tencent-ai/codebuddy-code（全平台支持，国内可访问）

554 console.log(' 尝试从 npm 安装 @tencent-ai/codebuddy-code...');

555 try {

556 execSync('npm install -g @tencent-ai/codebuddy-code', {

557 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L555

558 timeout: 300000

559 });

560

561 // 查找 npm 安装的 codebuddy-headless.js

562 const npmRootResult = execSync('npm root -g', { encoding: 'utf8', timeout: 10000 }).trim();

563 const headlessJsPath = path.join(npmRootResult, '@tencent-ai', 'codebuddy-code', 'dist', 'codebuddy-headless.js');

564

565 if (fs.existsSync(headlessJsPath)) {

566 // 创建 wrapper 脚本，让 codebuddy-headless 可以被直接调用

567 const binDir = getCodebuddyBinDir();

568 fs.mkdirSync(binDir, { recursive: true });

569 const binaryName = BINARY_NAMES[platform] || 'codebuddy-headless';

570 const wrapperPath = path.join(binDir, binaryName);

571

572 if (platform === 'win32') {

573 // Windows: 创建 .cmd wrapper

574 const cmdPath = wrapperPath.replace(/\.(exe)?$/, '.cmd');

575 fs.writeFileSync(cmdPath, `@echo off\r\nnode "${headlessJsPath}" %*\r\n`);

Lines 665-705javascript

665 }

666 // 等待进程完全退出

667 let retries = 10;

668 while (retries-- > 0 && isSciAgentRunning()) {

669 const sleep = require('util').promisify(setTimeout);

670 sleep(500);

671 }

672 return !isSciAgentRunning();

673 } catch (e) {

674 return false;

675 }

676}

677

678/**

679 * 尝试将临时文件替换为目标二进制文件

680 * 返回: 'replaced' | 'locked' | 'error'

681 */

682function tryReplaceBinary(tempPath, targetPath, installDir, version, platform) {

683 try {

684 // 先尝试直接复制

685 if (process.platform === 'win32') {

686 // Windows: 使用 PowerShell Copy-Item

687 // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK 解码，

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L685

688 // 中文安装路径会乱码导致复制失败）；并轮询等待 exe 解锁再覆盖。

689 const tmpScript = path.join(os.tmpdir(), `sciagent-replace-${process.pid}.ps1`);

690 const logFile = path.join(installDir, 'update-apply.log');

691 const esc = (s) => String(s).replace(/'/g, "''");

692 const scriptContent = [

693 `$ErrorActionPreference = 'Stop'`,

694 `$log = '${esc(logFile)}'`,

695 `function Write-Log([string]$msg) { try { $line = '[{0}] {1}' -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $msg; Add-Content -Path $log -Value $line -Encoding UTF8 } catch {} }`,

696 `Write-Log 'tryReplaceBinary: helper started'`,

697 `try {`,

698 ` $target = '${esc(targetPath)}'`,

699 ` if (Test-Path $target) {`,

700 ` $deadline = (Get-Date).AddSeconds(60)`,

701 ` $unlocked = $false`,

702 ` while ((Get-Date) -lt $deadline) {`,

703 ` try { $fs = [System.IO.File]::Open($target, 'Open', 'ReadWrite', 'None'); $fs.Close(); $unlocked = $true; break } catch { Start-Sleep -Milliseconds 500 }`,

704 ` }`,

705 ` if (-not $unlocked) { throw ('Timed out waiting for target to unlock: ' + $target) }`,