MalwarePublished 16 Jul 2026Updated 7 Aug 2026

@onescience/onecode (npm) · Malicious Code

Affects @onescience/onecodeSource GCVE Database

Malicious package : remove @onescience/onecode and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10717

What to do

Remove @onescience/onecode from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@onescience/onecode	Affected 1.14.50-202607161038 – 1.14.50-202608061753 51 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (713bf7fce40e177608dd5145e1662b4efd3da6c1597d9a1aeb15d7715b865205) The npm postinstall hook runs ensurePlatformBinary(), which downloads a.tgz archive from the hardcoded bare-IP URL https://218.90.133.98:4443/onecode_tgz/onecode-<ver>/onecode-linux-x64-<ver>.tgz, extracts it via `tar -xzf`, chmods the extracted file to 0o755, hardlinks it into bin/.onecode, and the shipped CLI launcher invokes it. The HTTPS request explicitly sets `rejectUnauthorized: false`, disabling TLS certificate verification, and no hash or signature check is performed on the downloaded artifact. The download destination is a bare IPv4 address on a non-standard port, not a publisher-owned domain or a recognized release host. The package name and launcher (@onescience/onecode) mirror the unrelated 'opencode' project — env-var fallbacks reference OPENCODE_BIN_PATH and bundled asset directories are named.opencode/session-seed and.opencode/oneskills — while the executable payload is retrieved from an unrelated hardcoded IP endpoint. Anyone controlling that host, or any on-path network attacker (TLS is disabled), can deliver arbitrary code that executes on every installer's machine.

Impact

Any user installing affected versions of @onescience/onecode will execute arbitrary code controlled by the attacker hosting the payload. This can lead to full compromise of the installer's environment. The lack of TLS certificate verification and absence of artifact integrity checks allow man-in-the-middle or remote host compromise to inject malicious payloads. The threat affects all users of the specified versions of the package.

Defensive guidance

Users should avoid installing the affected versions of @onescience/onecode listed. Verify package authenticity before installation and consider using package integrity verification tools. Monitor for updates from the package publisher or npm advisories for official fixes.

Summary

The @onescience/onecode npm package's postinstall hook runs a function that downloads a tarball from a hardcoded bare IPv4 address over HTTPS with TLS verification disabled (rejectUnauthorized: false). The tarball is extracted and an executable is installed and invoked. No hash or signature verification is performed on the downloaded artifact. The download source is not a publisher-owned domain but a bare IP on a non-standard port, enabling arbitrary code execution if the remote host or network is compromised. The package name and launcher mimic an unrelated project 'opencode', using environment variables and asset directories referencing 'opencode' while retrieving payloads from an unrelated IP endpoint. This behavior constitutes a supply chain malicious package threat.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:41 UTC

Technical details

References

Community reviews