{
  "projectId": "openalice",
  "title": "OpenAlice 的 npm 安装与原生发行链",
  "summary": "npm 入口是平台发行物的安装器。它选择与系统匹配的原生包并记录更新来源；本轮未逆向该原生程序中的交易逻辑。",
  "scope": "npm openalice@0.94.1 的 postinstall.mjs 发布安装器；REA 解析 1 个 JS 文件。未分析其原生应用二进制或交易模块。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:35:44.734592+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "安装器选择特定平台和架构的原生包",
      "detail": "postinstall 根据 darwin/linux/windows 与 arm64/x64 拼接 openalice 平台包名，再从该包的 release 目录链接程序与共享资源。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_1c781e0917b31709710b183d30164c17320c9812b41ecbbd829d9326f096f944"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/openalice/-/openalice-0.94.1.tgz"
      ]
    },
    {
      "title": "安装记录含发行版本与产物摘要",
      "detail": "安装脚本构造 install-source.json，记录仓库、固定版本、更新渠道和 artifactSha256；脚本还会调用原生程序的 --version 检查一致性。本轮仅静态分析脚本，没有执行安装或原生程序。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_1c781e0917b31709710b183d30164c17320c9812b41ecbbd829d9326f096f944"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/openalice/-/openalice-0.94.1.tgz"
      ]
    }
  ],
  "limitations": [
    "仅覆盖 npm 发行安装器，未分析原生程序或交易所适配器。",
    "版本检查逻辑存在不等于来源供应链已做全面安全验证。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "openalice@0.94.1",
      "url": "https://registry.npmjs.org/openalice/-/openalice-0.94.1.tgz",
      "sha256": "afc41673de85f181595faa52d62e7075eaef6364c7d0f649dd2cec7f096e2d8c"
    },
    {
      "label": "postinstall.mjs",
      "url": "https://registry.npmjs.org/openalice/-/openalice-0.94.1.tgz",
      "sha256": "a7f4857fb08ff14e562d67c0645a43053c3b4f205335470e06a7a61c768c0d38"
    }
  ],
  "evidenceIds": [
    "ev_1c781e0917b31709710b183d30164c17320c9812b41ecbbd829d9326f096f944"
  ],
  "reportUrl": "/research/rea/openalice.json",
  "coverage": {
    "parsedFiles": 1,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "5d90ee5f09413c6210fb9f86554c8dc06998491b7161fd3c3c3c5fc769bc0294",
    "inputFileCount": 1,
    "inputBytes": 3429,
    "npmIntegrityVerified": true,
    "analysisResult": "completed"
  }
}