Loading npm security reports…

@volcflink/volc-flink@0.2.6: AI-agent control-surface risk | LPM Firewall

registry / @volcflink/volc-flink / 0.2.6

@volcflink/volc-flink@0.2.6

Volcengine Serverless Flink command line interface.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs a downloader and can automatically install a global agent skill in an interactive terminal. This mutates a broad AI-agent control surface without an explicit user command or confirmation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall in an interactive terminal, or installation with VOLC_FLINK_INSTALL_SKILLS enabled.

Impact

A package installation can place a downloaded executable and globally install agent instructions affecting supported AI-agent tools.

Mechanism

Lifecycle downloader plus global npx-based agent-skill installation.

Policy narrative

The postinstall hook downloads and enables a platform executable. In interactive installs it then invokes npx to copy a companion skill globally; a non-interactive environment variable path defaults to the universal agent target. This is an unconsented lifecycle mutation of a broad AI-agent control surface, compounded by executable download without cryptographic integrity verification.

Rationale

The automatic postinstall hook both installs a remotely downloaded executable and can globally install agent skills without an explicit setup command. That concrete lifecycle control-surface mutation meets the publish-block policy.

Evidence

package.jsonnpm/bin/install.jsbin/volc-flinkskills/byted-serverlessflink-volc-flink

Network endpoints2

lf3-static.bytednsdoc.comskills.volces.com

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node npm/bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node npm/bin/install.js Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: const fs = require('fs'); L5: const http = require('http'); L6: const https = require('https'); L7: const path = require('path'); L8: const { spawnSync } = require('child_process'); L9: L10: const DEFAULT_DOWNLOAD_BASE = L11: 'https://lf3-static.bytednsdoc.com/obj/eden-cn/rupsm-[redacted]-flink'; L12: L13: const DEFAULT_SKILLS_URL = 'https://sk[redacted]/[redacted]'; L14: const DEFAULT_SKILLS_NAME = 'byted-serverlessflink-volc-flink'; ... L65:

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

•scripts.postinstall = node npm/bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

npm/bin/run.jsView file

3L4: const fs = require('fs'); L5: const os = require('os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

npm/bin/run.jsView on unpkg · L3

npm/bin/install.jsView file

1Install-time AI-agent control hijack evidence: L131: const { asset, exeName } = platformAsset(); L132: fs.mkdirSync(binDir(), { recursive: true }); L133: ... L344: if (agents.length > 0 && !agents.includes('auto')) { L345: args.push('-a', ...agents); L346: } Payload evidence from skills/byted-serverlessflink-volc-flink/LICENSE: L1: MIT License L2:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

npm/bin/install.jsView on unpkg · L1

4const fs = require('fs'); L5: const http = require('http'); L6: const https = require('https'); L7: const path = require('path'); L8: const { spawnSync } = require('child_process'); L9: ... L16: function packageRoot() { L17: return path.resolve(__dirname, '..', '..'); L18: } ... L24: function platformAsset() { L25: const platform = process.platform; L26: const arch = process.arch;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

npm/bin/install.jsView on unpkg · L4