registry / @tencentcloud/tmeet / 1.0.18

@tencentcloud/tmeet@1.0.18

腾讯会议 CLI 工具

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Installing the package invokes a bundled native executable automatically. It runs its authentication logout action, which clears local CLI login state without an explicit user request.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation triggers postinstall.

Impact

Loss of locally stored Tencent Meeting CLI authentication state and unconsented execution of a native binary.

Mechanism

Install hook executes bundled native logout command.

Attack narrative

During installation, npm runs scripts/cleanup.js. The script selects a platform-specific bundled binary, grants it execute permission where applicable, and invokes `auth logout`. This automatic command can remove the user's existing local authentication state and executes opaque native code outside an explicit CLI action.

AI rationale

The package contains an unconsented postinstall action that invokes a native logout operation and mutates user authentication state. This is concrete destructive install-hook behavior, not necessary package setup.

Evidence

package.jsonscripts/cleanup.jsdist/tmeet-macOS-Inteldist/tmeet-macOS-AppleSilicondist/tmeet-Linux-x86_64dist/tmeet-Linux-ARM64dist/tmeet-Windows-x86_64.exe

@tencentcloud/tmeet@1.0.18

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code