@volcengine/ark-cli@1.0.25

One or more suspicious static signals were detected.

npm postinstall during package installation

Can mutate a broad local AI-agent control surface without an explicit user command.

Downloaded binary execution followed by automatic AI-agent skill installation

An automatic postinstall downloads a native executable from a manifest-selected URL, installs it into bin/, and executes it. The executable is then invoked non-interactively with +connect --refresh; the package source states that this detects agents and installs skills into them. This is an unconsented install-time mutation path for local AI-agent integrations, and the native payload is not available for source inspection in the package.

The package performs unconsented postinstall execution of a downloaded native payload and automatically installs skills into local AI agents. Hash checking constrains the selected download but does not make the opaque binary or broad control-surface mutation safe.