registry / Credential exfiltration / @code.india/cli
@code.india/cli
code.in CLI — sovereign coding for India: keyless OAuth, durable memory, DPDP data-residency, with the code.in engine.
This report shows the evidence for @code.india/cli@0.1.2. 1 of 5 known versions is blocked or flagged. The newest version, 0.1.6, is flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe branding/domain mismatch is implemented in executable auth, configuration, and memory-sync paths, creating a concrete credential and data-routing chain. The hidden forced updater compounds the supply-chain risk; absence of install hooks does not remove the runtime behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run `codein login`, then use the CLI/plugins; a cached newer version activates the exit-time updater.
Impact
OAuth credentials and persisted user/project memory can be routed to code.ae infrastructure despite code.in branding; later execution can replace the global CLI without an explicit update command.
Mechanism
misbranded OAuth and memory egress plus detached forced global update
Attack narrative
A package advertised as `@code.india/cli` embeds code.ae configuration and sends its OAuth flow to `app.code.ae` and `code-ae-api.onrender.com`. The resulting bearer token is reused by plugins that synchronize local memory records to the credential API base. Separately, normal CLI use can register an exit handler that detached-runs `npm install -g codein-cli@latest --force` after a cache-based version check, replacing software without invoking the explicit update command.
AI rationale
The branding/domain mismatch is implemented in executable auth, configuration, and memory-sync paths, creating a concrete credential and data-routing chain. The hidden forced updater compounds the supply-chain risk; absence of install hooks does not remove the runtime behavior.
Evidence
package.jsoncodein.jsoncdist/index.jsdist/plugin/auth.jsdist/plugin/memory.js~/.code-ae/credentials.json~/.code-ae/update-check.json
Network endpoints3
code-ae-api.onrender.com/api/v1app.code.aeregistry.npmjs.org/@code.india%2Fcli
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- `dist/index.js` defaults OAuth login/exchange to `code-ae-api.onrender.com` and `app.code.ae`, not code.in.
- `codein.jsonc` identifies itself as code.ae and routes auth with `CODEAE_TOKEN`/`CODEAE_GATEWAY_URL`.
- `dist/plugin/memory.js` posts local memory records with the OAuth bearer token to the credential API base.
- `dist/index.js` schedules a detached `npm install -g codein-cli@latest --force` on exit after a cached update check.
- `dist/index.js` uses code.ae credential storage and login messaging throughout the code.in CLI.
Evidence against
- `package.json` has no preinstall, install, or postinstall lifecycle hook.
- OAuth exchange is reached through an explicit `login` command and uses a loopback callback with state validation.
- No obfuscated payload, eval, or foreign AI-agent configuration write was found in inspected package files.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
8 flagged · loading sourcedist/plugin/auth.jsView file
4import { promises as fs } from "node:fs";
L5: import { spawnSync } from "node:child_process";
L6: import { dirname } from "node:path";
High
Child Process
Package source references child process execution.
dist/plugin/auth.jsView on unpkg · L476function ps(script, input) {
L77: const res = run("powershell", ["-NoProfile", "-NonInteractive", "-Command", script], input);
L78: if (!res.ok) throw new Error(`credential vault (dpapi) failed: ${res.stderr.trim() || "nonzero exit"}`);
High
4import { promises as fs } from "node:fs";
L5: import { spawnSync } from "node:child_process";
L6: import { dirname } from "node:path";
...
L8: // src/config.ts
L9: var API_BASE = process.env["CODE_AE_API_BASE"] ?? "https://code-ae-api.onrender.com/api/v1";
L10: var WEB_BASE = process.env["CODE_AE_WEB_BASE"] ?? "https://app.code.ae";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/plugin/auth.jsView on unpkg · L4Findings
1 Critical6 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/plugin/auth.js
HighShelldist/plugin/auth.js
HighSame File Env Network Executiondist/plugin/auth.js
HighSandbox Evasion Gated Capabilitydist/plugin/auth.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/plugin/memory.js
MediumDynamic Requiredist/plugin/floor.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowFilesystem
Low
Affected versions and remediation
This report applies to @code.india/cli@0.1.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing @code.india/cli@0.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.