sino-bc-cli@1.8.5: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

sino-bc-cli@1.8.5: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sino-bc-cli@1.8.4 matchedIdentity = npm:c2luby1iYy1jbGk:1.8.4 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1#!/usr/bin/env node L2: 'use strict';const af=e;(function(i,l){const ad=e,m=i();while(!![]){try{const n=-parseInt(ad(0x32d))/0x1*(-parseInt(ad(0x3ee))/0x2)+-parseInt(ad(0x2b7))/0x3*(-parseInt(ad(0x265))/0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: 'use strict';const af=e;(function(i,l){const ad=e,m=i();while(!![]){try{const n=-parseInt(ad(0x32d))/0x1*(-parseInt(ad(0x3ee))/0x2)+-parseInt(ad(0x2b7))/0x3*(-parseInt(ad(0x265))/0...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

scripts/postinstall.cjsView file

19const result = spawnSync(process.execPath, [cliEntry, '/init', '--quiet'], { stdio: 'inherit', windowsHide: true, });

Medium

Suspicious Lifecycle Evidence

The install lifecycle automatically starts the bundled CLI with /init.

scripts/postinstall.cjsView on unpkg · L19

dist/SKILL.mdView file

19用全局 CLI `sino-bc-cli` 查询或操作 BeyondClick。本文件是**唯一对外技能**，也是决策页：按用户意图只读一份子技能，再执行命令。不要自己拼网关 HTTP，也不要一次读完全部子技能。 `/init` 之后本机目录是 `~/.agents/skills/sino-bc-cli/`，子技能嵌在其下（没有 `system/` / `custom/` 这一层）：

Medium

Ai Review Evidence

The shipped agent skill instructs agents to use this CLI and avoid direct gateway requests.

dist/SKILL.mdView on unpkg · L19

Source & flagged code

7 flagged

package.jsonView file

Lines 10-50json

10 "files": [

11 "dist/",

12 "README.md",

13 "LICENSE",

14 "scripts/postinstall.cjs"

15 ],

16 "publishConfig": {

17 "access": "public",

18 "registry": "https://registry.npmjs.org/"

19 },

20 "scripts": {

21 "build": "node --experimental-strip-types scripts/build.ts",

22 "build:no-mangle": "node --experimental-strip-types scripts/build.ts --no-mangle",

23 "typecheck": "tsc --noEmit",

24 "test": "node --require ts-node/register --test \"tests/**/*.test.ts\"",

25 "sync-api-doc": "node --require ts-node/register src/api-utils/run-sync.ts",

26 "dev": "ts-node src/index.ts",

27 "start": "node dist/index.js",

28 "clean": "rimraf dist",

29 "rebuild": "npm run clean && npm run build",

30 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "prepublishOnly": "npm run sync-api-doc && npm run rebuild",

32 "prepack": "npm run build",

33 "release:patch": "npm version patch && npm publish",

34 "release:minor": "npm version minor && npm publish",

35 "release:major": "npm version major && npm publish",

36 "publish:local": "node --experimental-strip-types scripts/publish.ts",

37 "publish:local:dry": "node --experimental-strip-types scripts/publish.ts --dry-run"

38 },

39 "engines": {

40 "node": ">=24.0.0"

41 },

42 "keywords": [

43 "beyondclick",

44 "cli",

45 "command-line",

46 "sino-bc-cli"

47 ],

48 "author": "BeyondClick",

49 "license": "MIT",

50 "dependencies": {

dist/index.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2'use strict';const af=e;(function(i,l){const ad=e,m=i();while(!![]){try

scripts/postinstall.cjsView file

Lines 1-29javascript

1/**

2 * npm 安装后自动注册 Agent 技能

3 * 使用 .cjs：scripts/package.json 为 "type": "module"，.js 无法使用 require

4 * dist 不存在时（本地尚未 build）静默跳过，避免打断 npm install

5 * 注册失败也不让安装失败，用户可随后执行 sino-bc-cli /init

6 */

7'use strict';

8

9const { existsSync } = require

dist/SKILL.mdView file

Lines 1-39markdown

1---

2name: sino-bc-cli

3description: >

4 Use when 查询或操作 BeyondClick 业务线、周策略生成、广告结构、广告成效，或配置 sino-bc-cli：

5 投放渠道/品类、业务线列表/详情/状态、周策略增删改查与策略生成、策略周期/消耗/红绿灯/客户满意度/ROAS；

6 Facebook / Google / TikTok 广告结构（账户、广告系列、广告组、广告、目标、出价、定向）

7 与广告成效（消耗、曝光、点击、购买、安装）；

8 SSO 组别；以及 /init、/get-config、/set-config。

9 用户提到业务线、周策略、策略生成、广告结构、广告层级、广告成效、biz-line、

10