registry / @coinbase/cdp-cli / 2.0.18

@coinbase/cdp-cli@2.0.18

CLI for the Coinbase Developer Platform API

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface. Residual risk is a guarded postinstall that updates package-owned workflow skills in a user-configured skillsDir.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install postinstall when CDP config exists with settings.skillsDir; runtime only via user-invoked cdp commands.

Impact

Configured users may get bundled CDP skills refreshed; user-invoked commands can make authenticated CDP API and wallet operations as documented.

Mechanism

first-party skill copy plus authenticated CDP CLI/MCP operations

Rationale

Source inspection shows a legitimate Coinbase CDP CLI with documented auth, wallet, MCP, and skill-management behavior; the install-time skill copy is guarded and first-party package-owned rather than a foreign control-surface hijack. No credential harvesting, stealth persistence, remote payload execution, or unconsented fund transfer was confirmed.

Evidence

package.jsonscripts/postinstall.mjsdist/index.jsdist/spec.jsonREADME.mdskills/cdp-accounts-send/SKILL.mdskills/*/SKILL.md~/.config/cdp/config.jsonconfigured settings.skillsDir

Network endpoints4

api.cdp.coinbase.com/platform/v2registry.npmjs.orgportal.cdp.coinbase.compaymaster.cdp.coinbase.com

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

postinstall copies bundled SKILL.md directories into configured settings.skillsDir, mutating an agent/workflow extension surface at install time.

Evidence against

postinstall is gated on existing CDP config settings.skillsDir and copies only bundled package-owned skills; no network or command execution in scripts/postinstall.mjs.
CLI network traffic is package-aligned to https://api.cdp.coinbase.com/platform/v2 and npm registry version checks.
Wallet/API secrets are used to sign CDP requests or stored via explicit cdp env commands; no exfiltration path found.
Wallet send/sign capabilities are documented user-invoked CDP operations, not install/import-time fund transfer.
Shell execution is limited to OS keyring helpers, jq/editor invocation, and user-invoked utilities.
dist/spec.json secret-like strings are OpenAPI examples/schema data, not executable credentials.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 106 KB of source, external domains: api.avax.network, api.cdp.coinbase.com, api.devnet.solana.com, api.mainnet-beta.solana.com, api.testnet.solana.com, arb1.arbitrum.io, eth.llamarpc.com, jqlang.github.io, mainnet.base.org, mainnet.optimism.io, polygon-rpc.com, portal.cdp.coinbase.com, registry.npmjs.org, rpc.hoodi.ethpandaops.io, rpc.sepolia.org, sepolia.base.org

Source & flagged code

10 flagged

package.jsonView file

Lines 1-34json

2 "name": "@coinbase/cdp-cli",

3 "version": "2.0.18",

4 "description": "CLI for the Coinbase Developer Platform API",

5 "type": "module",

6 "bin": {

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/spec.jsonView file

1patternName = supabase_service_key severity = critical line = 1 matchedText = {"openap...]}]}

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/spec.jsonView on unpkg · L1

1patternName = supabase_service_key severity = critical line = 1 matchedText = {"openap...]}]}

Critical

Secret Pattern

Supabase service role key (JWT) in dist/spec.json

dist/spec.jsonView on unpkg · L1

dist/index.jsView file

1#!/usr/bin/env node L2: var w={live:"https://api.cdp.coinbase.com/platform/v2"};var x={production:"live"};import{readFileSync as Ui}from"node:fs";import{dirname as Fi,join as Wi}from"node:path";import{fil... L3: if (-not ([System.Management.Automation.PSTypeName]'Win32.Cred').Type) { ... L19: } L20: `;function bt(e){let t=bo+e,r=Buffer.from(t,"utf16le").toString("base64");return xo("powershell.exe",["-NoProfile","-NonInteractive","-EncodedCommand",r],{encoding:"utf8",stdio:["p... L21: $ptr = [IntPtr]::Zero ... L41: } L42: [Runtime.InteropServices.Marshal]::FreeHGlobal($blob)`)}delete(t,r){try{bt(`[void][Win32.Cred]::CredDelete('${pe(xt(t,r))}', 1, 0)`)}catch{}}};var vt="cdp-cli",K,lr=!1;function Ue(... L43: `),lr=!0),K=null}return K}function Q(e){let t=Ue();if(!t)return null;try{return t.get(vt,e)}catch{return null}}function fe(e,t){let r=Ue();if(!r)return!1;try{return r.set(vt,e,t),!... L44: `,{mode:384})}function ye(e){return Q(`${e}:wallet`)}function Et(e,t){return fe(`${e}:wallet`,t)}function St(e){me(`${e}:wallet`)}function we(e,t){return t||process.env.CDP_ENV||e.... L45: `)),!W(n,r))throw new Error(`no URL for environment "${r}". Set url in config or use a built-in env n

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L1

50Trigger-reachable chain: manifest.bin -> dist/index.js L50: `)} L51: -----END PRIVATE KEY-----`}function At(e){let t;try{t=Buffer.from(e,"base64")}catch{throw new Error("wallet secret is not valid base64")}if(t.length<100||t.length>300)throw new Err... L52: `);return}let l=Math.max(14,...i.map(c=>c.length));for(let c of i){let u=r.environments[c]??{},d=W(u,c),p=u.key_id?u.key_id.length>40?u.key_id.slice(0,37)+"...":u.key_id:"(no key)"... ... L65: `||s==="\r"||s===""?(r.setRawMode(!1),r.pause(),r.removeListener("data",o),process.stderr.write(` L66: `),t(n)):s==="\x7F"||s==="\b"?n=n.slice(0,-1):s===""?process.exit(1):n+=s};r.on("data",o)}):new Promise(t=>{let r=Ge({input:process.stdin});r.once("line",n=>{r.close(),t(n)})})}fu... L67: Run: cdp env <name> --key-id=... --key-secret=... to configure.`),R(n.join(`

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L50

48patternName = private_key_rsa severity = critical line = 48 matchedText = `}var _o...----

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L48

48patternName = private_key_ec severity = critical line = 48 matchedText = `}var _o...----

Critical

Secret Pattern

EC private key in dist/index.js

dist/index.jsView on unpkg · L48

65`||s==="\r"||s===""?(r.setRawMode(!1),r.pause(),r.removeListener("data",o),process.stderr.write(` L66: `),t(n)):s==="\x7F"||s==="\b"?n=n.slice(0,-1):s===""?process.exit(1):n+=s};r.on("data",o)}):new Promise(t=>{let r=Ge({input:process.stdin});r.once("line",n=>{r.close(),t(n)})})}fu... L67: Run: cdp env <name> --key-id=... --key-secret=... to configure.`),R(n.join(` ... L73: ${l.join(` L74: `)}`)}function as(e,t){return e.FORCE_HYPERLINK==="0"?!1:e.FORCE_HYPERLINK?!0:!t||e.CI?!1:!!(/ghostty|iterm|wezterm|hyper/i.test(e.TERM_PROGRAM||"")||e.WT_SESSION||parseInt(e.VTE_V... L75: `),i="",l=!1),i+=(i?" ":"")+c}i&&e.write((l?t:" ".repeat(o))+i.trimEnd()+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L65

50`)} L51: -----END PRIVATE KEY-----`}function At(e){let t;try{t=Buffer.from(e,"base64")}catch{throw new Error("wallet secret is not valid base64")}if(t.length<100||t.length>300)throw new Err... L52: `);return}let l=Math.max(14,...i.map(c=>c.length));for(let c of i){let u=r.environments[c]??{},d=W(u,c),p=u.key_id?u.key_id.length>40?u.key_id.slice(0,37)+"...":u.key_id:"(no key)"... ... L65: `||s==="\r"||s===""?(r.setRawMode(!1),r.pause(),r.removeListener("data",o),process.stderr.write(` L66: `),t(n)):s==="\x7F"||s==="\b"?n=n.slice(0,-1):s===""?process.exit(1):n+=s};r.on("data",o)}):new Promise(t=>{let r=Ge({input:process.stdin});r.once("line",n=>{r.close(),t(n)})})}fu... L67: Run: cdp env <name> --key-id=... --key-secret=... to configure.`),R(n.join(`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L50

Findings

6 Critical3 High4 Medium5 Low

CriticalCritical Secretdist/spec.json

CriticalWallet Draindist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalSecret Patterndist/spec.json

CriticalSecret Patterndist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2var w={live:"https://api.cdp.coinbase.com/platform/v2"};var x={production:"live"};import{readFileSync as Ui}from"node:fs";import{dirname as Fi,join as Wi}from"node:path";import{fileURLToPath as Ji}from"node:url";function rr(e,t){let r=e??t;return Array.isArray(r)?r.find(n=>n!=="null")??r[0]??t:r}function de(e,t="string"){let r=e?.oneOf||e?.anyOf||e?.properties?"object":t;return rr(e?.type,r)}function nr(e,t){let r={...e?.properties??{}},n=[...e?.required??[]];if(Array.isArray(e?.allOf))for(let o of e.allOf){let s=t(o);s?.properties&&Object.assign(r,s.properties),Array.isArray(s?.required)&&n.p ...

3if (-not ([System.Management.Automation.PSTypeName]'Win32.Cred').Type) {

4 Add-Type -Namespace Win32 -Name Cred -MemberDefinition '

5 [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]

6 public static extern bool CredWrite(ref CREDENTIAL cred, int flags);

7 [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]

8 public static extern bool CredRead(string target, int type, int flags, out IntPtr cred);

9 [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]

10 public static extern bool CredDelete(string target, int type, int flags);

11 [DllImport("advapi32.dll")] public static extern void CredFree(IntPtr cred);

12 [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]

13 public struct CREDENTIAL {

14 public int Flags; public int Type; public string TargetName; public string Comment;

15 public long LastWritten; public int CredentialBlobSize; public IntPtr CredentialBlob;

16 public int Persist; public int AttributeCount; public IntPtr Attributes;

17 public string TargetAlias; public string UserName;

18 }'

19}

20`;function bt(e){let t=bo+e,r=Buffer.from(t,"utf16le").toString("base64");return xo("powershell.exe",["-NoProfile","-NonInteractive","-EncodedCommand",r],{encoding:"utf8",stdio:["pipe","pipe","pipe"]}).trimEnd()}var Me=class{get(t,r){try{let n=pe(xt(t,r));return bt(`

21$ptr = [IntPtr]::Zero

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L1

Long lines were clipped for display.

Lines 30-85javascript

30$blob = [Runtime.InteropServices.Marshal]::AllocHGlobal($bytes.Length)

31[Runtime.InteropServices.Marshal]::Copy($bytes, 0, $blob, $bytes.Length)

32$cred = New-Object Win32.Cred+CREDENTIAL

33$cred.Type = 1

34$cred.TargetName = '${o}'

35$cred.UserName = '${s}'

36$cred.CredentialBlobSize = $bytes.Length

48patternName = private_key_rsa severity = critical line = 48 matchedText = `}var _o...----

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L48

48patternName = private_key_ec severity = critical line = 48 matchedText = `}var _o...----

Critical

Secret Pattern

EC private key in dist/index.js

dist/index.jsView on unpkg · L48