registry / AI-agent control-surface risk / @volcflink/volc-flink
@volcflink/volc-flink
Volcengine Serverless Flink command line interface.
This report shows the evidence for @volcflink/volc-flink@0.2.6, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic postinstall hook both installs a remotely downloaded executable and can globally install agent skills without an explicit setup command. That concrete lifecycle control-surface mutation meets the publish-block policy.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall in an interactive terminal, or installation with VOLC_FLINK_INSTALL_SKILLS enabled.
Impact
A package installation can place a downloaded executable and globally install agent instructions affecting supported AI-agent tools.
Mechanism
Lifecycle downloader plus global npx-based agent-skill installation.
Policy narrative
The postinstall hook downloads and enables a platform executable. In interactive installs it then invokes npx to copy a companion skill globally; a non-interactive environment variable path defaults to the universal agent target. This is an unconsented lifecycle mutation of a broad AI-agent control surface, compounded by executable download without cryptographic integrity verification.
AI rationale
The automatic postinstall hook both installs a remotely downloaded executable and can globally install agent skills without an explicit setup command. That concrete lifecycle control-surface mutation meets the publish-block policy.
Evidence
package.jsonnpm/bin/install.jsbin/volc-flinkskills/byted-serverlessflink-volc-flink
Network endpoints2
lf3-static.bytednsdoc.comskills.volces.com
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest runs npm/bin/install.js automatically after installation.
- The installer downloads an executable, makes it executable, and performs no cryptographic integrity check.
- In an interactive install, the lifecycle script automatically starts companion skill installation without a confirmation prompt.
- The installer invokes npx skills add globally and targets the universal agent set when explicitly enabled non-interactively.
Evidence against
- Skill installation is skipped in non-interactive environments unless an environment variable opts in.
- The normal skill source is bundled with the package and its version is checked.
- No package self-dependency or credential-harvesting code was found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node npm/bin/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg4scripts.postinstall = node npm/bin/install.js
Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution.
L4: const fs = require('fs');
L5: const http = require('http');
L6: const https = require('https');
L7: const path = require('path');
L8: const { spawnSync } = require('child_process');
L9:
L10: const DEFAULT_DOWNLOAD_BASE =
L11: 'https://lf3-static.bytednsdoc.com/obj/eden-cn/rupsm-[redacted]-flink';
L12:
L13: const DEFAULT_SKILLS_URL = 'https://sk[redacted]/[redacted]';
L14: const DEFAULT_SKILLS_NAME = 'byted-serverlessflink-volc-flink';
...
L65:
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4•scripts.postinstall = node npm/bin/install.js
Medium
Ambiguous Install Lifecycle Script
Findings
1 Critical3 High5 Medium5 Low
CriticalAi Agent Control Hijacknpm/bin/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighUnverified Remote Native Payload Installpackage.json
HighSandbox Evasion Gated Capabilitynpm/bin/install.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirenpm/bin/run.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @volcflink/volc-flink@0.2.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing @volcflink/volc-flink@0.2.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.