Loading npm security reports…

@comate/zulu@1.7.16: Malicious npm security report (Block) | LPM Firewall

registry / @comate/zulu / 1.7.16

@comate/zulu@1.7.16

AI Coding Agent

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Running the CLI's agent runtime enables a built-in command hook. After matching Git commit or push activity, it transmits project metadata and a username to a hard-coded network service. A bundled skill can also fetch and execute an unpinned remote binary.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs the Zulu agent and its command tool performs a matching Git commit or push; the bundled skill is activated when explicitly invoked.

Impact

Repository identifiers, branches, commit hashes, review URLs, and usernames can leave the machine; remote binary content can execute with the invoking user's permissions.

Mechanism

Agent hook metadata exfiltration and remote binary download-and-execute.

Attack narrative

The package embeds an agent hook configuration that launches a reporter around command-tool use. When a Git commit and later a matching push are observed, the reporter obtains Git metadata, constructs a request containing repository and user information, and posts it to a hard-coded IP endpoint. It also records request details in the user's home-directory state. Separately, a bundled skill retrieves an updateable platform binary from a debug object-storage endpoint and executes it without a pinned digest.

AI rationale

The package contains a concrete, runtime-triggered project-metadata exfiltration path to a hard-coded endpoint and an unpinned remote binary execution path. The lack of an npm lifecycle hook reduces install-time scope but does not remove the malicious runtime behavior.

Evidence

comate-engine/assets/hooks/hooks.builtin.jsoncomate-engine/assets/hooks/local-swe-task-reporter.jscomate-engine/assets/skills/ku-doc-manage/bin/ku

Source & flagged code

25 flagged · loading source

scripts/postinstall.jsView file

13L14: import {execSync} from 'node:child_process'; L15: import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

226const findCmd = isWindows L227: ? `powershell -Command "Get-ChildItem -Path '${searchDir}' -Filter 'rg.exe' -Recurse ` + L228: '| Select-Object -First 1 -ExpandProperty FullName"'

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L226

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.15 matchedPath = scripts/postinstall.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

comate-engine/node_modules/win-ca/lib/hash.jsView file

8module.exports = dispatch; L9: bufferFrom = Buffer.from || function(data, encoding){ L10: return new Buffer(data, encoding);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

comate-engine/node_modules/win-ca/lib/hash.jsView on unpkg · L8

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView file

1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo... L2: /*!

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1

1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo... L2: /*! ... L7: */ L8: !function(e){var A=er,t=C.extname,i=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function r(e){if(!e||"string"!=typeof e)return!1;var t=i.exec(e),r=t&&A[t[1].toLowerCase()];return r&&r.c... L9: /*! ... L35: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let $_;P_.Settings=Z_.default,P_.stat=function(e,A,t){"function"!=typeof A?W_.read(e,X_(A),t... L36: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const AD="function"==typeof queueMicrotask?queueMicrotask.bind("undefined"!=typeof window?windo... L37: /** ... L4

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1

dist/bundle/index.jsView file

1Trigger-reachable chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*! ... L7: */ L8: !function(e){var t=mimeDb,r=require$$1__default.extname,n=/^\s*([^;\s]*)(?:;|\s|$)/,A=/^text\//i;function i(e){if(!e||"string"!=typeof e)return!1;var r=n.exec(e),i=r&&t[r[1].toLowe... L9: /*! ... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function ru

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @comate/zulu@1.7.18 matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.18 similarity = 0.895 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bundle/index.jsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bundle/index.js: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... !function(e){var t=mimeDb,r=require$$1__default.extname,n=/^\s*([^;\s]*)(?:;|\s|$)/,A=/^text\//i;function i(e){if(!e||"string"!=typeof e)return!1;var r=n.exec(e),i=r&&t[r[1].toLowe... */lodash$2.exports,function(e,t){(function(){var r,n="Expected a function",A="__lodash_hash_undefined__",i="__lodash_placeholder__",s=32,a=128,o=256,c=1/0,l=9007199254740991,g=NaN,... */var isExtendable=function(e){return null!=e&&("object"==typeof e||"

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView file

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView file

•path = comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylib kind = native_binary sizeBytes = 161704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView on unpkg

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView file

•path = comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasm kind = wasm_module sizeBytes = 1358224 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView on unpkg

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.py kind = payload_in_excluded_dir sizeBytes = 3934 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView on unpkg

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.15 matchedPath = comate-engine/assets/hooks/local-swe-task-reporter.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/hooks/local-swe-task-reporter.jsView on unpkg

comate-engine/assets/skills/ku-doc-manage/bin/kuView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.15 matchedPath = comate-engine/assets/skills/ku-doc-manage/bin/ku matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/skills/ku-doc-manage/bin/kuView on unpkg

Findings

6 Critical14 High7 Medium4 Low

CriticalSame File Env Network Executioncomate-engine/node_modules/@comate/plugin-engine/dist/index.js

CriticalBrowser Credential Phishingcomate-engine/node_modules/@comate/plugin-engine/dist/index.js

CriticalDownload Executecomate-engine/node_modules/@comate/plugin-engine/dist/index.js

CriticalRemote Asset Decode Executecomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/index.js

CriticalPrevious Version Dangerous Deltadist/bundle/index.js

HighChild Processscripts/postinstall.js

HighShellscripts/postinstall.js

HighCredential Redirect Persistencedist/bundle/index.js

HighCommand Output Exfiltrationcomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighSandbox Evasion Gated Capabilitycomate-engine/node_modules/@comate/plugin-engine/dist/index.js

HighObfuscated Payload Loadercomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighRemote Agent Bridgecomate-engine/node_modules/@comate/plugin-engine/dist/index.js

HighCross File Remote Execution Contextcomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighTrigger Reachable Command Output Exfiltrationdist/bundle/index.js

HighPayload In Excluded Dircomate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.py

HighSemantic Analysis Limitedcomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighKnown Malware Source Similarityscripts/postinstall.js

HighKnown Malware Source Similaritycomate-engine/assets/hooks/local-swe-task-reporter.js

HighKnown Malware Source Similaritycomate-engine/assets/skills/ku-doc-manage/bin/ku

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarycomate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylib

MediumShips Wasm Modulecomate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasm

MediumShips Build Helpercomate-engine/assets/skills/icode/scripts/common.sh

MediumOversized Source Filedist/bundle/index.js

MediumStructural Risk Force Deep Review

LowWeak Cryptocomate-engine/node_modules/win-ca/lib/hash.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings