Loading npm security reports…

@volcengine/ark-cli@1.0.27: AI-agent control-surface risk | LPM Firewall

registry / @volcengine/ark-cli / 1.0.27

@volcengine/ark-cli@1.0.27

火山方舟 ARK 平台命令行工具

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package downloads and executes an opaque external binary. The lifecycle then non-interactively refreshes and installs skills into detected local AI agents.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall outside CI

Impact

Foreign local AI-agent control surfaces may be modified without an explicit user command.

Mechanism

remote binary bootstrap followed by automatic AI-agent skill installation

Policy narrative

The postinstall hook obtains a platform binary from manifest-controlled URLs, verifies its digest, and executes it. Unless it detects CI, it automatically invokes the binary with +connect --refresh. The package source says this action detects agents and installs skills into all of them, while the implementation is opaque because the binary is fetched at install time. This is an unconsented install-time mutation path for local AI-agent control surfaces.

AI rationale

This is a concrete, automatic postinstall path that executes a remote binary and installs skills into detected AI agents without an explicit user command. Hash verification does not make the unconsented broad agent mutation safe.

Evidence

package.jsonscripts/postinstall.jsmanifest.jsonbin/

Network endpoints2

lf3-static.bytednsdoc.comgithub.com

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node scripts/postinstall.js" }

High

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L13

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @volcengine/ark-cli@1.0.25 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHZvbGNlbmdpbmUvYXJrLWNsaQ:1.0.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7b7d51a5723fefb6 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @volcengine/ark-cli@1.0.25 matchedPath = scripts/postinstall.js matchedIdentity = npm:QHZvbGNlbmdpbmUvYXJrLWNsaQ:1.0.25 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/postinstall.jsView on unpkg

328// —— +connect --refresh:下载最新 skill 到 <pkg>/skills/ 再装进各 agent —— // skill 的下载/解压/校验【收口在 Go 二进制】(internal/sk[redacted]),postinstall // 不再自己下 skill。+connect 非交互(自动检测 agent + 全装),有/无 tty 都能跑:有 // tty 时把日志接到 /dev/tty(体验更好),无 tty 时走默认 stdio(connect 不读 stdin、 // 不会卡)。整体是【增强项】:下载或安装失败仅告警,不影响包安装结果(exit 0)。 let ttyFd = null; try { ttyFd = fs.openSync("/dev/tty", "r+"); } catch (_) { /

High

Suspicious Lifecycle Evidence

Outside CI, postinstall non-interactively runs +connect --refresh; source states it detects agents and installs skills into all of them.

scripts/postinstall.jsView on unpkg · L328