registry / @comate/zulu / 1.6.1

@comate/zulu@1.6.1

AI Coding Agent

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 690 KB of source, external domains: ghproxy.net, github.com

Oversized source lightweight scan

comate-engine/server.js7.82 MB file, sampled 256 KB

FilesystemEnvironmentVarsCryptoHighEntropyStringsMinified

dist/bundle/index.js3.02 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStrings

Source & flagged code

12 flagged

package.jsonView file

Lines 1-21json

2 "name": "@comate/zulu",

3 "version": "1.6.1",

4 "description": "AI Coding Agent",

5 "license": "MIT",

6 "type": "module",

7 "engines": {

8 "node": ">=20.10.0"

9 },

10 "bin": {

11 "zulu": "./bin/cli.mjs"

12 },

13 "repository": {

14 "type": "git",

15 "url": "ssh://wuweiqi@icode.baidu.com:8235/baidu/ide/comate-plugin-host"

16 },

17 "scripts": {

18 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 }

20}

comate-engine/assets/skills/ku-doc-manage/references/export_sheet.mdView file

Lines 9-49markdown

9```bash

10$SKILL_DIR/bin/ku export-sheet --doc-id <doc-guid>

11# 或

12$SKILL_DIR/bin/ku export-sheet --url <sheet-url>

13```

15## 参数说明

17| 参数 | 必填 | 说明 | 示例 |

scripts/postinstall.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execSync } from 'node:child_process';

4import { existsSync, mkdirSync, rmSync, writeFileSync, createWriteStream } from 'node:fs';

5import { join, dirname } from 'node:path';

6import

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

dist/bundle/index.jsView file

•path = dist/bundle/index.js kind = oversized_source_file sizeBytes = 3163107 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bundle/index.jsView on unpkg

comate-engine/assets/skills/code-security/references/vul_analysis-sensitive_false_positive.mdView file

Lines 118-187markdown

118

119- 全 `X`、`*`、`?`、`<>`、`{}` 等占位符：`"XXXXXXXXXX"`、`"<your-ak-here>"`、`"{ak}"`、`"your_password"`、`"changeme"`、`"REPLACE_ME"`

comate-engine/assets/skills/code-security/references/vul_repair_sensitive.mdView file

384patternName = generic_password severity = medium line = 384 matchedText = std::str...xx";

Medium

Secret Pattern

Hardcoded password in comate-engine/assets/skills/code-security/references/vul_repair_sensitive.md

comate-engine/assets/skills/code-security/references/vul_repair_sensitive.mdView on unpkg · L384

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

comate-engine/assets/skills/ku-doc-manage/references/export_sheet.mdView file

29patternName = supabase_service_key severity = critical line = 29 matchedText = "downloa...=1",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

comate-engine/assets/skills/ku-doc-manage/references/export_sheet.md

Findings

6 Critical3 High6 Medium5 Low

CriticalCritical Secretcomate-engine/assets/skills/ku-doc-manage/references/export_sheet.md

CriticalSecret Patterncomate-engine/assets/skills/ku-doc-manage/references/export_sheet.md

CriticalSecret Patterncomate-engine/assets/skills/code-security/references/vul_analysis-sensitive_false_positive.md

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilityscripts/postinstall.js