Loading npm security reports…

@sciagent/cli@1.3.73: Malicious npm security report (Block) | LPM Firewall

registry / @sciagent/cli / 1.3.73

@sciagent/cli@1.3.73

SciAgent CLI - AI Research Assistant

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package automatically fetches opaque executable payloads and changes global user state. Running the CLI launches the downloaded SciAgent binary.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation triggers postinstall; invoking sciagent launches the downloaded payload.

Impact

A remote server or globally installed dependency can supply code that executes with the installing user's privileges.

Mechanism

Lifecycle download, global package installation, and execution of remote binaries.

Attack narrative

The postinstall hook runs without a separate user command, downloads an executable to the user's SciAgent directory, and installs a separate global npm package. The downloaded payload is accepted based on size rather than a cryptographic integrity check. The command wrapper subsequently starts that downloaded binary and includes remote update logic, creating a supply-chain path from installation to execution outside the reviewed package.

Rationale

This package uses an automatic lifecycle hook to install external code globally and stage opaque remote executables for later execution without integrity verification. That is concrete install-hook abuse, even though the visible JavaScript does not harvest credentials.

Evidence

package.jsonscripts/postinstall.jsbin/sciagent.js$HOME/.sciagent/bin/sciagent$HOME/.sciagent/bin/codebuddy-headlessglobal npm installation of @tencent-ai/codebuddy-code

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/sciagent.jsView file

19L20: const { spawn, execSync } = require('child_process'); L21: const path = require('path');

High

Child Process

Package source references child process execution.

bin/sciagent.jsView on unpkg · L19

•matchType = normalized_sha256 matchedPackage = @sciagent/cli@1.3.72 matchedPath = bin/sciagent.js matchedIdentity = npm:QHNjaWFnZW50L2NsaQ:1.3.72 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/sciagent.jsView on unpkg

scripts/postinstall.jsView file

685if (process.platform === 'win32') { L686: // Windows: 使用 PowerShell Copy-Item L687: // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK 解码，

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L685

8L9: const { execSync } = require('child_process'); L10: const path = require('path'); L11: const fs = require('fs'); L12: const https = require('https'); L13: const http = require('http'); ... L41: // 自建服务器配置（备用源） L42: const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26597?token=b3xgnhe2Sk'; L43: ... L87: function getCodebuddyBinDir() { L88: const platform = process.platform; L89: if (platform === 'win32') {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

8L9: const { execSync } = require('child_process'); L10: const path = require('path'); L11: const fs = require('fs'); L12: const https = require('https'); L13: const http = require('http'); ... L41: // 自建服务器配置（备用源） L42: const SELF_HOSTED_URL = process.env.RELEASE_SERVER_URL || 'https://px1-jcy.matpool.com:26597?token=b3xgnhe2Sk'; L43: ... L87: function getCodebuddyBinDir() { L88: const platform = process.platform; L89: if (platform === 'win32') {

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.js

bin/sciagent.js#virtual:normalized:round1View file

121if (process.platform === "win32") { L122: // Windows: 使用 PowerShell L123: // 注意：脚本必须以 UTF-8 BOM 写入——PowerShell 5.1 对无 BOM 的 ... L126: const logFile = path.join(installDir, "update-apply.log"); L127: const esc = (s) => String(s).replace(/"/g, \"""\");\r\n const scriptContent = [\r\n `$ErrorActionPreference = "Stop"`,\r\n `$log = "${esc(logFile)}"`,\r\n ... L128: // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/sciagent.js#virtual:normalized:round1View on unpkg · L121

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/sciagent.js#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "@sciagent/cli",

3 "version": "1.3.73",

4 "description": "SciAgent CLI - AI Research Assistant",

5 "main": "index.js",

6 "files": [

7 "bin/",

8 "scripts/",

9 "index.js"

10 ],

11 "bin": {

12 "sciagent": "bin/sciagent.js"

13 },

14 "scripts": {

15 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "optionalDependencies": {},

18 "keywords": [

19 "ai",

20 "research",

21 "agent",

22 "cli",

23 "codebuddy"

24 ],

25 "author": "SciAgent Team",

26 "license": "MIT",

27 "repository": {

28 "type": "git",

29 "url": "https://gitee.com/garva/research-agent.git"

30 },

31 "engines": {

32 "node": ">=16"

33 },

34 "os": [

35 "linux",

bin/sciagent.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2

3/**

4 * SciAgent CLI 薄壳脚本

5 * 自动识别平台并调用对应的预编译二进制文件

6 *

7 * 二进制查找策略：

8 * 1. %LOCALAPPDATA%\sciagent\bin\ (Windows) 或 ~/.sciagent/bin/ (Linux/Mac)

9 * - 带严格版本校验（.version文件必须匹配CURRENT_VERSION）

10 * - 版本不匹配时自动从 Release Server 下载正确版本

11 * 2. 本地开发目录（仅开发模式）

12

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2

3/**

4 * SciAgent CLI postinstall 脚本

5 * 1. 自动检测并安装平台特定的二进制包

6 * 2. 自动下载 CodeBuddy SDK 二进制文件（使用国内镜像源）

7 */

8

9const { execSync } = require('child_process');

bin/sciagent.js#virtual:normalized:round1View file

121if (process.platform === "win32") { L122: // Windows: 使用 PowerShell L123: // 注意：脚本必须以 UTF-8 BOM 写入——PowerShell 5.1 对无 BOM 的 ... L126: const logFile = path.join(installDir, "update-apply.log"); L127: const esc = (s) => String(s).replace(/"/g, \"""\");\r\n const scriptContent = [\r\n `$ErrorActionPreference = "Stop"`,\r\n `$log = "${esc(logFile)}"`,\r\n ... L128: // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/sciagent.js#virtual:normalized:round1View on unpkg · L121

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/sciagent.js#virtual:normalized:round1View on unpkg

Lines 535-575javascript

535 console.log(` ⚠️ 提取的 SDK 二进制校验失败: ${check.desc}`);

536 try { fs.unlinkSync(targetPath); } catch (e) {}

537 try { fs.unlinkSync(wheelPath); fs.unlinkSync(scriptPath); fs.rmdirSync(tmpDir); } catch (e) {}

538 throw new Error(`SDK 二进制校验失败: ${check.desc}`);

539 }

540 console.log(`✅ CodeBuddy SDK 安装成功！(PyPI wheel)`);

541 console.log(` 路径: ${targetPath}`);

542 console.log(` 大小: ${(stats.size / (1024 * 1024)).toFixed(1)} MB`);

543 console.log(` 架构: ${check.desc}`);

544

545 try { fs.unlinkSync(wheelPath); fs.unlinkSync(scriptPath); fs.rmdirSync(tmpDir); } catch (e) {}

546 return true;

547 }

548 } catch (e) {

549 console.log(` ⚠️ PyPI 下载失败: ${e.message}`);

550 }

551 }

552

553 // 策略2: 从 npm 安装 @tencent-ai/codebuddy-code（全平台支持，国内可访问）

554 console.log(' 尝试从 npm 安装 @tencent-ai/codebuddy-code...');

555 try {

556 execSync('npm install -g @tencent-ai/codebuddy-code', {

557 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L555

558 timeout: 300000

559 });

560

561 // 查找 npm 安装的 codebuddy-headless.js

562 const npmRootResult = execSync('npm root -g', { encoding: 'utf8', timeout: 10000 }).trim();

563 const headlessJsPath = path.join(npmRootResult, '@tencent-ai', 'codebuddy-code', 'dist', 'codebuddy-headless.js');

564

565 if (fs.existsSync(headlessJsPath)) {

566 // 创建 wrapper 脚本，让 codebuddy-headless 可以被直接调用

567 const binDir = getCodebuddyBinDir();

568 fs.mkdirSync(binDir, { recursive: true });

569 const binaryName = BINARY_NAMES[platform] || 'codebuddy-headless';

570 const wrapperPath = path.join(binDir, binaryName);

571

572 if (platform === 'win32') {

573 // Windows: 创建 .cmd wrapper

574 const cmdPath = wrapperPath.replace(/\.(exe)?$/, '.cmd');

575 fs.writeFileSync(cmdPath, `@echo off\r\nnode "${headlessJsPath}" %*\r\n`);

Lines 665-705javascript

665 }

666 // 等待进程完全退出

667 let retries = 10;

668 while (retries-- > 0 && isSciAgentRunning()) {

669 const sleep = require('util').promisify(setTimeout);

670 sleep(500);

671 }

672 return !isSciAgentRunning();

673 } catch (e) {

674 return false;

675 }

676}

677

678/**

679 * 尝试将临时文件替换为目标二进制文件

680 * 返回: 'replaced' | 'locked' | 'error'

681 */

682function tryReplaceBinary(tempPath, targetPath, installDir, version, platform) {

683 try {

684 // 先尝试直接复制

685 if (process.platform === 'win32') {

686 // Windows: 使用 PowerShell Copy-Item

687 // 脚本必须以 UTF-8 BOM 写入（PowerShell 5.1 无 BOM 按 ANSI/GBK 解码，

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L685

688 // 中文安装路径会乱码导致复制失败）；并轮询等待 exe 解锁再覆盖。

689 const tmpScript = path.join(os.tmpdir(), `sciagent-replace-${process.pid}.ps1`);

690 const logFile = path.join(installDir, 'update-apply.log');

691 const esc = (s) => String(s).replace(/'/g, "''");

692 const scriptContent = [

693 `$ErrorActionPreference = 'Stop'`,

694 `$log = '${esc(logFile)}'`,

695 `function Write-Log([string]$msg) { try { $line = '[{0}] {1}' -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $msg; Add-Content -Path $log -Value $line -Encoding UTF8 } catch {} }`,

696 `Write-Log 'tryReplaceBinary: helper started'`,

697 `try {`,

698 ` $target = '${esc(targetPath)}'`,

699 ` if (Test-Path $target) {`,

700 ` $deadline = (Get-Date).AddSeconds(60)`,

701 ` $unlocked = $false`,

702 ` while ((Get-Date) -lt $deadline) {`,

703 ` try { $fs = [System.IO.File]::Open($target, 'Open', 'ReadWrite', 'None'); $fs.Close(); $unlocked = $true; break } catch { Start-Sleep -Milliseconds 500 }`,

704 ` }`,

705 ` if (-not $unlocked) { throw ('Timed out waiting for target to unlock: ' + $target) }`,