encrata-cli@0.4.1

One or more suspicious static signals were detected.

npm install runs postinstall, then user invokes encrata

Remote release compromise or asset replacement could execute arbitrary native code as the installing user.

postinstall downloads and extracts native CLI binary

On installation, npm runs install.js. It selects platform and architecture, downloads an archive from GitHub releases, extracts the encrata executable with tar or PowerShell, copies it to bin/encrata-bin, chmods it executable, and removes temporary files. The shipped bin/encrata shim later spawns that binary. This is not confirmed malware, but it is an install hook executing an unverified remote native binary supply path.

Source inspection shows a transparent native-binary installer for the advertised CLI, with no credential theft or unrelated malicious behavior in the package JS. Because install-time download and execution are not checksum-pinned, warn rather than mark clean.