sino-bc-cli@1.8.22: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

sino-bc-cli@1.8.22: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.cjsView file

10const { join } = require('path'); L11: const { spawnSync } = require('child_process'); L12:

High

Child Process

Package source references child process execution.

scripts/postinstall.cjsView on unpkg · L10

2Cross-file remote execution chain: scripts/postinstall.cjs spawns dist/index.js; helper contains network access plus dynamic code execution. L2: * npm 安装后自动注册 Agent 技能 L3: * 使用 .cjs：scripts/package.json 为 "type": "module"，.js 无法使用 require L4: * dist 不存在时（本地尚未 build）静默跳过，避免打断 npm install ... L10: const { join } = require('path'); L11: const { spawnSync } = require('child_process'); L12: L13: const cliEntry = join(__dirname, '..', 'dist', 'index.js'); L14:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.cjsView on unpkg · L2

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sino-bc-cli@1.8.20 matchedIdentity = npm:c2luby1iYy1jbGk:1.8.20 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1#!/usr/bin/env node L2: 'use strict';const aB=c;(function(e,h){const aA=c,i=e();while(!![]){try{const l=-parseInt(aA(0x450))/0x1+-parseInt(aA(0x34d))/0x2+parseInt(aA(0x468))/0x3*(-parseInt(aA(0x527))/0x4)...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';const aB=c;(function(e,h){const aA=c,i=e();while(!![]){try{const l=-parseInt(aA(0x450))/0x1+-parseInt(aA(0x34d))/0x2+parseInt(aA(0x468))/0x3*(-parseInt(aA(0x527))/0x4)...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/skills/custom/biz-line-strategy-generate/scripts/test_cli_json.pyView file

•path = dist/skills/custom/biz-line-strategy-generate/scripts/test_cli_json.py kind = build_helper sizeBytes = 3182 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/custom/biz-line-strategy-generate/scripts/test_cli_json.pyView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 10-50json

10 "files": [

11 "dist/",

12 "README.md",

13 "LICENSE",

14 "scripts/postinstall.cjs"

15 ],

16 "publishConfig": {

17 "access": "public",

18 "registry": "https://registry.npmjs.org/"

19 },

20 "scripts": {

21 "build": "node --experimental-strip-types scripts/build.ts",

22 "build:no-mangle": "node --experimental-strip-types scripts/build.ts --no-mangle",

23 "typecheck": "tsc --noEmit",

24 "test": "node --require ts-node/register --test \"tests/**/*.test.ts\"",

25 "sync-api-doc": "node --require ts-node/register src/catalog/sync/run-sync.ts",

26 "dev": "ts-node src/index.ts",

27 "start": "node dist/index.js",

28 "clean": "rimraf dist",

29 "rebuild": "npm run clean && npm run build",

30 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "prepublishOnly": "npm run sync-api-doc && npm run rebuild",

32 "prepack": "npm run build",

33 "release:patch": "npm version patch && npm publish",

34 "release:minor": "npm version minor && npm publish",

35 "release:major": "npm version major && npm publish",

36 "publish:local": "node --experimental-strip-types scripts/publish.ts",

37 "publish:local:dry": "node --experimental-strip-types scripts/publish.ts --dry-run"

38 },

39 "engines": {

40 "node": ">=24.0.0"

41 },

42 "keywords": [

43 "beyondclick",

44 "cli",

45 "command-line",

46 "sino-bc-cli"

47 ],

48 "author": "BeyondClick",

49 "license": "MIT",

50 "dependencies": {

scripts/postinstall.cjsView file

Lines 1-29javascript

1/**

2 * npm 安装后自动注册 Agent 技能

3 * 使用 .cjs：scripts/package.json 为 "type": "module"，.js 无法使用 require

4 * dist 不存在时（本地尚未 build）静默跳过，避免打断 npm install

5 * 注册失败也不让安装失败，用户可随后执行 sino-bc-cli /init

6 */

7'use strict';

8

9const { existsSync } = require

dist/index.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2'use strict';const aB=c;(function(e,h){const aA=c,i=e();while(!![]){try

dist/skills/custom/biz-line-strategy-generate/scripts/test_cli_json.pyView file

•path = dist/skills/custom/biz-line-strategy-generate/scripts/test_cli_json.py kind = build_helper sizeBytes = 3182 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/custom/biz-line-strategy-generate/scripts/test_cli_json.pyView on unpkg