registry / Staged payload carrier / @sciagent/cli / 1.3.71

@sciagent/cli@1.3.71

SciAgent CLI - AI Research Assistant

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The lifecycle hook performs unconsented remote executable installation and persistent system changes, creating a concrete supply-chain execution surface. Static source does not establish direct theft or a self-dependency chain, so this is downgraded to a warning rather than blocked as malware.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation triggers postinstall; running sciagent launches the downloaded binary.

Impact

A compromised release host, mirror, or selected wheel can provide code that is installed without cryptographic integrity verification and then executed.

Mechanism

Automatic remote binary acquisition, global package installation, and execution.

AI rationale

Evidence

package.jsonscripts/postinstall.jsbin/sciagent.js~/.sciagent/bin/sciagent~/.sciagent/bin/codebuddy-headless%LOCALAPPDATA%\sciagent\binUser PATH

Network endpoints6

jihulab.compx1-jcy.matpool.compypi.orgmirrors.cloud.tencent.commirrors.aliyun.compypi.tuna.tsinghua.edu.cn

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Installation automatically runs a postinstall script.
The postinstall script downloads executable payloads from external release hosts into the user home directory without a hash or signature check.
The installer executes generated Python and can globally install another npm package during installation.
On Windows, installation permanently appends npm's global bin directory to the user PATH.
The CLI later launches the downloaded binary and performs background update checks.

Evidence against

No source code reads user files, harvests environment values beyond installation paths and a release-server override, or sends collected data.
No runtime dependency on this package itself was declared.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/sciagent.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * SciAgent CLI 薄壳脚本

5 * 自动识别平台并调用对应的预编译二进制文件

6 *

7 * 二进制查找策略：

8 * 1. %LOCALAPPDATA%\sciagent\bin\ (Windows) 或 ~/.sciagent/bin/ (Linux/Mac)

9 * - 带严格版本校验（.version文件必须匹配CURRENT_VERSION）

10 * - 版本不匹配时自动从 Release Server 下载正确版本

11 * 2. 本地开发目录（仅开发模式）

12 * 3. 未找到时自动从 Release Server 下载

13 *

14 * 注意：不再从npm optionalDependencies中查找二进制，因为：

15 * - npm缓存中的旧包可能包含旧版二进制

16 * - npm可能修改package.json版本号来匹配请求，但二进制文件仍是旧的

17 * - 超过250MB的包无法发布到npm

18 */

20const { spawn, execSync } = require('child_process');

21const path = require('path');

High

Child Process

Package source references child process execution.

bin/sciagent.jsView on unpkg · L19

22const fs = require('fs');

23const os = require('os');

24const https = require('https');

25const http = require('http');

27// 当前版本号 - 与 postinstall.js 和 package.json 保持同步

28const CURRENT_VERSION = '1.3.71';

30// Releases 下载源配置（优先级从高到低）

31// JihuLab 通用包仓库（国内 CDN，速度快）作为主源

32// sciagent.tech 自建服务器作为备用源

33const JIHULAB_PROJECT_ID = '351778';

34const JIHULAB_DEPLOY_TOKEN_USER = 'gitlab+deploy-token-15400';

35const JIHULAB_DEPLOY_TOKEN = 'gldt-5kp7mgt4ztyyBMx1Uvn6';

36const JIHULAB_BASE_URL = `https://jihulab.com/api/v4/projects/${JIHULAB_PROJECT_ID}/packages/generic/sciagent`;

37const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26597?token=b3xgnhe2Sk';

39// Parse SELF_HOSTED_URL to separate base URL from query params (e.g. ?token=xxx)

scripts/postinstall.jsView file

685if (process.platform === 'win32') { L686: // Windows: 使用 PowerShell Copy-Item L687: // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK 解码，

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L685

8L9: const { execSync } = require('child_process'); L10: const path = require('path'); L11: const fs = require('fs'); L12: const https = require('https'); L13: const http = require('http'); ... L41: // 自建服务器配置（备用源） L42: const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26597?token=b3xgnhe2Sk'; L43: ... L87: function getCodebuddyBinDir() { L88: const platform = process.platform; L89: if (platform === 'win32') {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.js

bin/sciagent.js#virtual:normalized:round1View file

121if (process.platform === "win32") { L122: // Windows: 使用 PowerShell L123: // 注意：脚本必须以 UTF-8 BOM 写入——PowerShell 5.1 对无 BOM 的 ... L126: const logFile = path.join(installDir, "update-apply.log"); L127: const esc = (s) => String(s).replace(/"/g, \"""\");\r\n const scriptContent = [\r\n `$ErrorActionPreference = "Stop"`,\r\n `$log = "${esc(logFile)}"`,\r\n ... L128: // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/sciagent.js#virtual:normalized:round1View on unpkg · L121

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/sciagent.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/sciagent.jsView file

19L20: const { spawn, execSync } = require('child_process'); L21: const path = require('path');

High

Child Process

Package source references child process execution.

bin/sciagent.jsView on unpkg · L19

Findings

8 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/sciagent.js

HighShellscripts/postinstall.js

HighSame File Env Network Executionbin/sciagent.js#virtual:normalized:round1

HighSandbox Evasion Gated Capabilityscripts/postinstall.js

HighInstall Named Payload Filescripts/postinstall.js

HighRuntime Package Installscripts/postinstall.js

HighSemantic Analysis Limitedbin/sciagent.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Low

Affected versions and remediation

This report applies to @sciagent/cli@1.3.71.

See all versions of @sciagent/cli for other recorded verdicts.

Review the evidence and your use of @sciagent/cli@1.3.71 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 08:25:34.618Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.