encrata-cli@0.9.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

encrata-cli@0.9.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2scripts.postinstall = node install.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L2: L3: const { existsSync, mkdirSync, createWriteStream, chmodSync, unlinkSync, copyFileSync, rmSync } = require("fs"); L4: const path = require("path"); L5: const https = require("https"); L6: const { execSync } = require("child_process"); ... L30: L31: const ext = process.platform === "win32" ? ".zip" : ".tar.gz"; L32: // Name of the binary *inside* the GoReleaser archive. ... L37: const assetName = `encrata_${VERSION}_${platform}_${arch}${ext}`; L38: const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${assetName}`; L39: ... L52: return new Promise((resolve, reject) => {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

19"scripts": { "postinstall": "node install.js"

Medium

Suspicious Lifecycle Evidence

`postinstall` runs installer automatically.

package.jsonView on unpkg · L19

install.jsView file

51function download(url, dest) { return new Promise((resolve, reject) => { const request = https.get(url, (res) => { if (res.statusCode === 302 || res.statusCode === 301) { return download(res.headers.location, dest).then(resolve).catch(reject);

Medium

Ai Review Evidence

Installer downloads a native archive and follows redirects without checksum/signature verification.

install.jsView on unpkg · L51

75console.log(`Downloading encrata v${VERSION} for ${platform}/${arch}...`); await download(url, archivePath); mkdirSync(extractDir, { recursive: true }); if (ext === ".tar.gz") { execSync(`tar -xzf "${archivePath}" -C "${extractDir}" ${archiveBinName}`, { stdio: "ignore" }); } else { execSync(`powershell -command "Expand-Archive -Path '${archivePath}' -DestinationPath '${extractDir}' -Force"`, { stdio: "ignore" }); } copyFileSync(path.join(extractDir, archiveBinName), destPath); chmodSync(destPath, 0o755);

Medium

Ai Review Evidence

Downloaded executable is copied into package bin and launched by the CLI shim.

install.jsView on unpkg · L75