registry / @tencentcloud/tmeet / 1.0.17

@tencentcloud/tmeet@1.0.17

腾讯会议 CLI 工具

AI Security Review

scanned 29d ago · by lpm-firewall-ai

Installing the package automatically executes a bundled native program and logs the user out of Tencent Meeting. This is an unconsented destructive change to the package's authentication state.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

Existing Tencent Meeting CLI authentication can be removed during package installation.

Mechanism

Postinstall chmods and runs a platform native binary with auth logout.

Attack narrative

On npm installation, package.json invokes scripts/cleanup.js. The script selects the current platform binary, sets executable permissions, and runs it with auth logout. This performs an unrequested authentication-state cleanup during installation rather than after an explicit user command. The invoked payload is a bundled native executable, limiting source-level verification of its complete behavior.

AI rationale

The automatic lifecycle hook performs a concrete destructive action by logging out the user and executes opaque native code. Although the binary appears aligned with a Tencent Meeting CLI, that does not justify unconsented logout during installation.

Evidence

package.jsonscripts/cleanup.jsscripts/tmeet.jsdist/tmeet-macOS-Inteldist/tmeet-macOS-AppleSilicondist/tmeet-Linux-x86_64dist/tmeet-Linux-ARM64dist/tmeet-Windows-x86_64.exe

@tencentcloud/tmeet@1.0.17

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code