registry / @sciagent/cli / 1.3.72

@sciagent/cli@1.3.72

SciAgent CLI - AI Research Assistant

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package automatically downloads unverified executable payloads and globally installs a separate AI package. Running the CLI launches the downloaded executable from the user profile.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation triggers postinstall; invoking sciagent launches the installed binary.

Impact

An external server or globally installed dependency can supply code that runs as the installing user.

Mechanism

Lifecycle download-and-execute loader with global package installation and PATH mutation.

Attack narrative

The npm postinstall hook fetches large binaries from package-controlled external endpoints, treats a size check as sufficient validation, and writes them into the user profile. It also silently runs a global npm installation of a separate CodeBuddy AI package and may permanently alter PATH. The launcher later executes the externally supplied binary. This is an unconsented lifecycle loader and broad global dependency mutation, not a self-contained npm CLI.

Rationale

The source establishes automatic postinstall mutation, opaque remote binary delivery without cryptographic verification, global AI-package installation, and subsequent execution. These behaviors create a concrete install-hook abuse path.

Evidence

package.jsonscripts/postinstall.jsbin/sciagent.js~/.sciagent/bin/$LOCALAPPDATA/sciagent/bin/

Network endpoints3

jihulab.compx1-jcy.matpool.compypi.org

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The package runs a postinstall script automatically.
The postinstall script globally installs a separate CodeBuddy AI package without a user command.
The postinstall script downloads opaque native binaries from external servers and accepts them based on size rather than a cryptographic signature or hash.
The CLI launcher executes the downloaded binary from the user profile.
On Windows, postinstall permanently changes the user's PATH.

Evidence against

No credential harvesting or data exfiltration was found in the inspected JavaScript.
The downloaded files are named as SciAgent and CodeBuddy components, consistent with the stated CLI purpose.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 91.6 KB of source, external domains: files.pythonhosted.org, gitee.com, jihulab.com, mirrors.aliyun.com, mirrors.cloud.tencent.com, px1-jcy.matpool.com, pypi.org, pypi.tuna.tsinghua.edu.cn, sciagent.tech

Source & flagged code

9 flagged

package.jsonView file

Lines 1-35json

2 "name": "@sciagent/cli",

3 "version": "1.3.72",

4 "description": "SciAgent CLI - AI Research Assistant",

5 "main": "index.js",

6 "files": [

7 "bin/",

8 "scripts/",

9 "index.js"

10 ],

11 "bin": {

12 "sciagent": "bin/sciagent.js"

13 },

14 "scripts": {

15 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "optionalDependencies": {},

18 "keywords": [

19 "ai",

20 "research",

21 "agent",

22 "cli",

23 "codebuddy"

24 ],

25 "author": "SciAgent Team",

26 "license": "MIT",

27 "repository": {

28 "type": "git",

29 "url": "https://gitee.com/garva/research-agent.git"

30 },

31 "engines": {

32 "node": ">=16"

33 },

34 "os": [

35 "linux",

bin/sciagent.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * SciAgent CLI 薄壳脚本

5 * 自动识别平台并调用对应的预编译二进制文件

6 *

7 * 二进制查找策略：

8 * 1. %LOCALAPPDATA%\sciagent\bin\ (Windows) 或 ~/.sciagent/bin/ (Linux/Mac)

9 * - 带严格版本校验（.version文件必须匹配CURRENT_VERSION）

10 * - 版本不匹配时自动从 Release Server 下载正确版本

11 * 2. 本地开发目录（仅开发模式）

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3/**

4 * SciAgent CLI postinstall 脚本

5 * 1. 自动检测并安装平台特定的二进制包

6 * 2. 自动下载 CodeBuddy SDK 二进制文件（使用国内镜像源）

7 */

9const { execSync } = require('child_process');

bin/sciagent.js#virtual:normalized:round1View file

121if (process.platform === "win32") { L122: // Windows: 使用 PowerShell L123: // 注意：脚本必须以 UTF-8 BOM 写入——PowerShell 5.1 对无 BOM 的 ... L126: const logFile = path.join(installDir, "update-apply.log"); L127: const esc = (s) => String(s).replace(/"/g, \"""\");\r\n const scriptContent = [\r\n `$ErrorActionPreference = "Stop"`,\r\n `$log = "${esc(logFile)}"`,\r\n ... L128: // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/sciagent.js#virtual:normalized:round1View on unpkg · L121

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/sciagent.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/sciagent.jsView file

19L20: const { spawn, execSync } = require('child_process'); L21: const path = require('path');

High

Child Process

Package source references child process execution.

bin/sciagent.jsView on unpkg · L19

scripts/postinstall.jsView file

685if (process.platform === 'win32') { L686: // Windows: 使用 PowerShell Copy-Item L687: // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK 解码，

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L685

8L9: const { execSync } = require('child_process'); L10: const path = require('path'); L11: const fs = require('fs'); L12: const https = require('https'); L13: const http = require('http'); ... L41: // 自建服务器配置（备用源） L42: const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26597?token=b3xgnhe2Sk'; L43: ... L87: function getCodebuddyBinDir() { L88: const platform = process.platform; L89: if (platform === 'win32') {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L8

555try { L556: execSync('npm install -g @tencent-ai/codebuddy-code', { L557: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L555

bin/sciagent.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/sciagent.js#virtual:normalized:round1View on unpkg · L121

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/sciagent.js#virtual:normalized:round1View on unpkg

Findings

8 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/sciagent.js

HighShellscripts/postinstall.js

HighSame File Env Network Executionbin/sciagent.js#virtual:normalized:round1

HighSandbox Evasion Gated Capabilityscripts/postinstall.js

HighInstall Named Payload Filescripts/postinstall.js

HighRuntime Package Installscripts/postinstall.js

HighSemantic Analysis Limitedbin/sciagent.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings