Loading npm security reports…

@volcengine/ark-cli@1.0.23: AI-agent control-surface risk | LPM Firewall

registry / @volcengine/ark-cli / 1.0.23

@volcengine/ark-cli@1.0.23

火山方舟 ARK 平台命令行工具

AI Security Review

scanned 22d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall downloads a native arkcli binary and then non-interactively runs +connect --refresh, which auto-detects local agents and installs skills into them. README names Claude Code, OpenCode, and Codex as targets, so this is install-time mutation of foreign agent control surfaces without an explicit user command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install of @volcengine/ark-cli, which runs the postinstall script unless CI or ARKCLI_SKIP_POSTINSTALL=1.

Impact

Third-party coding agents can receive Ark skills and related config during package install, without the user running arkcli +connect.

Mechanism

unconsented postinstall agent skill injection via a downloaded binary

Policy narrative

On npm install, postinstall fetches a native arkcli binary from the ByteDance CDN, verifies a baked sha256, and executes it. Except in CI, it then runs arkcli +connect --refresh even without a TTY. Package comments say that command auto-detects agents and installs skills into all of them; the README names Claude Code, OpenCode, and Codex. Install docs present +connect as a later explicit step, so the lifecycle run is not consented. Global installs also enroll silent automatic updates on new machines. Skill install logic lives in the opaque Go binary, but the JavaScript hook itself is an unconsented write into foreign agent control surfaces.

AI rationale

The postinstall hook downloads a native binary and non-interactively runs arkcli +connect --refresh to auto-detect local agents and install skills into them. That is unconsented install-time mutation of foreign and broad AI-agent control surfaces, so the package should be blocked.

Evidence

package.json

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node scripts/postinstall.js" },

High

Suspicious Lifecycle Evidence

package.json runs scripts/postinstall.js automatically on npm postinstall.

package.jsonView on unpkg · L13

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @volcengine/ark-cli@1.0.20 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHZvbGNlbmdpbmUvYXJrLWNsaQ:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5e6de367ea043cfd signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @volcengine/ark-cli@1.0.20 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHZvbGNlbmdpbmUvYXJrLWNsaQ:1.0.20 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/postinstall.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @volcengine/ark-cli@1.0.31 matchedIdentity = npm:QHZvbGNlbmdpbmUvYXJrLWNsaQ:1.0.31 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "@volcengine/ark-cli",

3 "version": "1.0.23",

4 "description": "火山方舟 ARK 平台命令行工具",

5 "bin": {

6 "arkcli": "scripts/run.js"

7 },

8 "files": [

9 "scripts/run.js",

10 "scripts/postinstall.js",

11 "manifest.json"

12 ],

13 "scripts": {

14 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

High

Suspicious Lifecycle Evidence

package.json runs scripts/postinstall.js automatically on npm postinstall.

package.jsonView on unpkg · L13

16 "engines": {

17 "node": ">=16"

18 },

19 "os": [

20 "darwin",

21 "linux",

22 "win32"

23 ],

24 "cpu": [

25 "x64",

26 "arm64"

27 ],

28 "license": "Apache-2.0",

29 "repository": {

30 "type": "git",

31 "url": "git+https://github.com/volcengine/ark-cli.git"

32 }

33}

34

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @volcengine/ark-cli@1.0.20 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHZvbGNlbmdpbmUvYXJrLWNsaQ:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5e6de367ea043cfd signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @volcengine/ark-cli@1.0.20 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHZvbGNlbmdpbmUvYXJrLWNsaQ:1.0.20 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/postinstall.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @volcengine/ark-cli@1.0.31 matchedIdentity = npm:QHZvbGNlbmdpbmUvYXJrLWNsaQ:1.0.31 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.js