registry / @tencentcloud/tmeet / 1.0.16

@tencentcloud/tmeet@1.0.16

腾讯会议 CLI 工具

AI Security Review

scanned 24d ago · by lpm-firewall-ai

Installing the package executes a bundled native binary without a user command. The visible arguments request logout, but the binary is stripped and cannot be fully audited statically.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs postinstall.

Impact

It may alter existing tmeet authentication state during installation; unverified native behavior remains an install-time risk.

Mechanism

Permission change followed by native binary execution with auth logout arguments.

AI rationale

The package has a real unconsented install-time native execution path, but the readable code limits its stated action to tmeet logout and does not establish malicious behavior. Treat the opaque lifecycle execution as unresolved risk rather than a confirmed attack.

Evidence

package.jsonscripts/cleanup.jsdist/tmeet-Linux-x86_64

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Installation automatically runs a cleanup script.
The cleanup script changes a bundled binary's permissions and executes its auth logout command.

@tencentcloud/tmeet@1.0.16

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code