The confirmed risk is install-time retrieval of an opaque platform executable from the package author's GitHub release. Source inspection found no direct malware behavior in the shipped JavaScript, but the downloaded binary is not inspectable from this package and has no hash check.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; later user invokes encrata CLI
Impact
Potential execution of unverified native code when the CLI is run
Mechanism
postinstall native binary downloader and launcher shim
Attack narrative
On npm install, package.json runs install.js. The script selects platform and architecture, downloads a release archive from github.com/Encratahq/encrata-cli, extracts encrata/encrata.exe, copies it to bin/encrata-bin, chmods it, and deletes the archive. The committed bin/encrata shim later executes that downloaded binary. The JavaScript does not exfiltrate data or modify foreign agent/control surfaces, but it creates an unresolved native-code supply-chain risk.
Rationale
The behavior is package-aligned for a CLI distributed as a native binary, and shipped JS has no concrete malicious actions. Because install-time download of an unverified opaque executable remains unresolved by static package inspection, warn rather than block or mark clean.
Evidence
package.jsoninstall.jsbin/encrataREADME.mdbin/encrata-binbin/.extractbin/encrata_0.4.4_<platform>_<arch>.<ext>
Network endpoints1
/Encratahq/encrata-cli/releases/download/v0.4.4/encrata_0.4.4_<platform>_<arch>.<ext>