encrata-cli@0.11.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

encrata-cli@0.11.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2scripts.postinstall = node install.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L2: L3: const { existsSync, mkdirSync, createWriteStream, chmodSync, unlinkSync, copyFileSync, rmSync } = require("fs"); L4: const path = require("path"); L5: const https = require("https"); L6: const { execSync } = require("child_process"); ... L30: L31: const ext = process.platform === "win32" ? ".zip" : ".tar.gz"; L32: // Name of the binary *inside* the GoReleaser archive. ... L37: const assetName = `encrata_${VERSION}_${platform}_${arch}${ext}`; L38: const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${assetName}`; L39: ... L52: return new Promise((resolve, reject) => {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

19"scripts": { "postinstall": "node install.js"

Medium

Suspicious Lifecycle Evidence

postinstall automatically downloads a platform-native archive.

package.jsonView on unpkg · L19

install.jsView file

75console.log(`Downloading encrata v${VERSION} for ${platform}/${arch}...`); await download(url, archivePath);

Medium

Suspicious Lifecycle Evidence

postinstall automatically downloads a platform-native archive.

install.jsView on unpkg · L75

51function download(url, dest) { return new Promise((resolve, reject) => { const request = https.get(url, (res) => { if (res.statusCode === 302 || res.statusCode === 301) { return download(res.headers.location, dest).then(resolve).catch(reject);

Medium

Ai Review Evidence

Redirect targets and archive contents have no checksum or signature verification.

install.jsView on unpkg · L51

85copyFileSync(path.join(extractDir, archiveBinName), destPath); chmodSync(destPath, 0o755);

Medium

Ai Review Evidence

The downloaded binary is installed and later executed by the CLI shim.

install.jsView on unpkg · L85

bin/encrataView file

21const result = spawnSync(binPath, process.argv.slice(2), { stdio: "inherit" });

Medium

Ai Review Evidence

The downloaded binary is installed and later executed by the CLI shim.

bin/encrataView on unpkg · L21

Source & flagged code

8 flagged

package.jsonView file

Lines 1-28json

1{

2 "name": "encrata-cli",

3 "version": "0.11.0",

4 "description": "Encrata CLI — intelligence lookups from your terminal",

5 "bin": {

6 "encrata": "bin/encrata"

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

7 },

8 "keywords": ["encrata", "osint", "email-lookup", "phone-lookup", "domain-lookup", "ip-lookup", "darkweb", "web-scraping", "screenshot", "face-recognition", "intelligence", "cli"],

9 "author": "Encrata <hello@encrata.com>",

10 "license": "MIT",

11 "homepage": "https://encrata.com",

12 "repository": {

13 "type": "git",

14 "url": "git+https://github.com/Encratahq/encrata-cli.git"

15 },

16 "engines": {

17 "node": ">=14"

18 },

19 "scripts": {

20 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

Medium

Suspicious Lifecycle Evidence

postinstall automatically downloads a platform-native archive.

package.jsonView on unpkg · L19

21 },

22 "files": [

23 "bin/",

24 "install.js",

25 "README.md"

26 ]

27}

28

install.jsView file

Lines 31-97javascript

31const ext = process.platform === "win32" ? ".zip" : ".tar.gz";

32// Name of the binary *inside* the GoReleaser archive.

33const archiveBinName = process.platform ===

bin/encrataView file

Lines 1-29text

1#!/usr/bin/env node

2

3// Launcher shim. This file is committed and shipped in the npm package so that

4// npm always has a `bin` target to symlink onto PATH at install time (npm links

5// bins *before* postinstall runs). The actual platform binary is downloaded by

6// install.js into the same directory as `encrata-bin` and exec'd from here.

7

8const { spawnSync } = require("child_process");

9const { existsSync } = require("fs");

10const path = require("path");

11

12const binName = process.platform === "win32" ? "encrata-bin.exe" : "encrata-bin";