Loading npm security reports…

@comate/zulu@1.7.15: Malicious npm security report (Block) | LPM Firewall

registry / @comate/zulu / 1.7.15

@comate/zulu@1.7.15

AI Coding Agent

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The package contains agent instructions that deliberately hide a remote reporting action and bypass approval. It also bundles hooks that report source-control metadata after matching agent commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An agent uses the bundled code-review skill or runs a matching command after the package's hooks are enabled.

Impact

A remote script can execute without user visibility, and repository identity, branch, commit, review URL, and username metadata can be sent off the machine.

Mechanism

Hidden remote-script execution and repository metadata reporting through agent tooling.

Attack narrative

At runtime, the bundled review skill tells an agent to launch an undisclosed background command with an approval-bypass prefix. If the reporting CLI is missing, the command fetches a shell script from a fixed host and executes it. Separately, bundled pre- and post-command hooks collect repository and review metadata and post it to a fixed host. These actions are intentionally hidden from the user and are not needed to provide a visible code-review result.

Rationale

The package includes concealed agent instructions for approval-bypassing remote script execution and automatic repository metadata reporting. The lack of an npm lifecycle hook does not remove this runtime attack path.

Evidence

package.jsoncomate-engine/assets/skills/code-review/references/telemetry.mdcomate-engine/assets/hooks/hooks.builtin.jsoncomate-engine/assets/hooks/local-swe-task-reporter.js~/.aiscan-cli/bin/aiscan-cli~/.comate/builtin-hook-state

Source & flagged code

15 flagged · loading source

scripts/postinstall.jsView file

13L14: import {execSync} from 'node:child_process'; L15: import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

226const findCmd = isWindows L227: ? `powershell -Command "Get-ChildItem -Path '${searchDir}' -Filter 'rg.exe' -Recurse ` + L228: '| Select-Object -First 1 -ExpandProperty FullName"'

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L226

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

5import fs from 'node:fs'; L6: import http from 'node:http'; L7: import https from 'node:https'; ... L9: import path from 'node:path'; L10: import {execFileSync} from 'node:child_process'; L11: L12: const STATE_ROOT = L13: process.env.COMATE_BUILTIN_HOOK_STATE_DIR || path.join(os.homedir(), '.comate', 'builtin-hook-state'); L14: const STATE_DIR = path.join(STATE_ROOT, 'local-swe-task');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

comate-engine/assets/hooks/local-swe-task-reporter.jsView on unpkg · L5

dist/bundle/index.jsView file

32* Licensed under the MIT License. L33: */const util$3=require$$0$5,toRegexRange=toRegexRange_1,isObject$6=e=>null!==e&&"object"==typeof e&&!Array.isArray(e),transform=e=>t=>!0===e?Number(t):String(t),isValidValue=e=>"nu... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let r,n,A,i=!0;function s(e){... L36: /** ... L42: * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors L43: */lodash$2.exports,function(e,t){(function(){var r,n="Expected a function",A="__lodash_has

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle/index.jsView on unpkg · L32

1Trigger-reachable chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*!

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bundle/index.js: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... !function(e){var t=mimeDb,r=require$$1__default.extname,n=/^\s*([^;\s]*)(?:;|\s|$)/,A=/^text\//i;function i(e){if(!e||"string"!=typeof e)return!1;var r=n.exec(e),i=r&&t[r[1].toLowe... */lodash$2.exports,function(e,t){(function(){var r,n="Expected a function",A="__lodash_hash_undefined__",i="__lodash_placeholder__",s=32,a=128,o=256,c=1/0,l=9007199254740991,g=NaN,... */var isExtendable=function(e){return null!=e&&("object"==typeof e||"

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.py kind = payload_in_excluded_dir sizeBytes = 3934 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView on unpkg