@comate/zulu@1.7.17

AI Coding Agent

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has a concrete automatic agent-hook reporting path and ships remote executable-refresh and credentialed-upload capabilities. Because there is no npm lifecycle trigger and the additional capabilities require explicit invocation, this is suspicious rather than confirmed malware.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Running the agent with its built-in hooks enabled and issuing matching git commands; invoking the bundled skill commands.

Impact

Project metadata can leave the machine automatically during agent use; user-directed skills can transfer files or execute refreshed helpers.

Mechanism

Built-in agent hooks report git metadata, while skills perform credentialed storage and remote binary retrieval.

AI rationale

Evidence

comate-engine/assets/hooks/hooks.builtin.jsoncomate-engine/assets/hooks/local-swe-task-reporter.jscomate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjscomate-engine/assets/skills/ku-doc-manage/bin/ku~/.comate/builtin-hook-state/local-swe-task

Network endpoints2

10.11.157.60:8301morpho.bj.bcebos.com/soqa-debug

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

A bundled hook configuration runs the local SWE reporter before and after agent run-command events.
The reporter sends repository, branch, commit, review URL, and user-name metadata to a hard-coded internal endpoint after matching a push.
A bundled storage skill reads configured cloud credentials and can upload an explicitly selected file.
A bundled documentation launcher downloads or replaces an executable from a remote object-storage host when invoked.

Evidence against

The published manifest has no preinstall, install, or postinstall lifecycle script.
The reporter is limited to configured agent hook events and matching commit or push commands.
The storage script requires a named command action and a caller-provided file path.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinified

Source & flagged code

23 flagged

scripts/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// ripgrep 自举 postinstall。既服务 @comate/zulu，也被 build-tui.mjs 原样拷进 comatecli(TUI) 发布包。

3//

4// 解析优先级（与 src/utils/defaultRipgrep.ts 契约一致）：

5// 0. 系统 PATH 有 rg (>=12) → 直接用，零副作用（本脚本提前 return）

6// 1. bundle 内预置二进制 (策略B) → <包根>/ripgrep-binary/<target>/rg ← build 期随包 staging

7// 2. bundle 内 .rg-path 缓存 → 同次安装复用

8// 3. 家目录韧性缓存 → ~/.comate/ripgrep-binary/<target>/rg ← 跨重装/自更新存活，杜绝反复下载

9// 4. 下载（内网镜像优先→ghproxy→github）→ 落 3 的韧性缓存位置

10//

11// 纯逻辑（版本比较/平台映射/下载源生成）抽在 ./postinstallCore.mjs（可单测）。本文件只保留有副作用的编排，

12// 且 main() 以 import-guard 收口——被 `import` 时不自动执行，只有作为脚本被直接 node 执行才跑。

14import {execSync} from 'node:child_process';

15import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

16 existsSync,

17 mkdirSync,

18 rmSync,

19 writeFileSync,

20 readFileSync,

21 copyFileSync,

22 chmodSync,

23 realpathSync,

24 createWriteStream,

25} from 'node:fs';

26import {join, dirname} from 'node:path';

27import {homedir} from 'node:os';

28import {fileURLToPath} from 'node:url';

29import https from 'node:https';

30import http from 'node:http';

31import {

32 RIPGREP_VERSION,

33 MIN_RG_VERSION,

Lines 206-246javascript

206 await downloadWithNodeHttps(url, tmpFile);

207 }

208 if (existsSync(tmpFile)) {

209 console.error(`✓ 从 ${sourceName} 下载成功`);

210 return true;

211 }

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.15 matchedPath = scripts/postinstall.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

comate-engine/node_modules/win-ca/lib/hash.jsView file

Lines 1-28javascript

1// Generated by LiveScript 1.6.0

2var crypto, forge, der2, asn1, toASN1, bufferFrom;

3crypto = require('crypto');

4forge = require('./forge');

5der2 = require(

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2'use strict';

4import crypto from 'node:crypto';

5import fs from 'node:fs';

6import http from 'node:http'

dist/bundle/index.jsView file

32* Licensed under the MIT License. L33: */const util$3=require$$0$5,toRegexRange=toRegexRange_1,isObject$6=e=>null!==e&&"object"==typeof e&&!Array.isArray(e),transform=e=>t=>!0===e?Number(t):String(t),isValidValue=e=>"nu... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let r,n,A,i=!0;function s(e){... L36: /** ... L42: * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors L43: */lodash$2.exports,function(e,t){(function(){var r,n="Expected a function",A="__lodash_has

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle/index.jsView on unpkg · L32

1Trigger-reachable chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*!

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bundle/index.js: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... !function(e){var t=mimeDb,r=require$$1__default.extname,n=/^\s*([^;\s]*)(?:;|\s|$)/,A=/^text\//i;function i(e){if(!e||"string"!=typeof e)return!1;var r=n.exec(e),i=r&&t[r[1].toLowe... */lodash$2.exports,function(e,t){(function(){var r,n="Expected a function",A="__lodash_hash_undefined__",i="__lodash_placeholder__",s=32,a=128,o=256,c=1/0,l=9007199254740991,g=NaN,... */var isExtendable=function(e){return null!=e&&("object"==typeof e||"

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView file

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView file

•path = comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylib kind = native_binary sizeBytes = 161704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView on unpkg

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView file

•path = comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasm kind = wasm_module sizeBytes = 1358224 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView on unpkg

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.py kind = payload_in_excluded_dir sizeBytes = 3934 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView on unpkg

comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.15 matchedPath = comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjs matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjsView on unpkg

comate-engine/assets/skills/ku-doc-manage/bin/kuView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.15 matchedPath = comate-engine/assets/skills/ku-doc-manage/bin/ku matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/skills/ku-doc-manage/bin/kuView on unpkg

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @comate/zulu@1.7.9 matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.9 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg

Source & flagged code

23 flagged · loading source

scripts/postinstall.jsView file

13L14: import {execSync} from 'node:child_process'; L15: import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

226const findCmd = isWindows L227: ? `powershell -Command "Get-ChildItem -Path '${searchDir}' -Filter 'rg.exe' -Recurse ` + L228: '| Select-Object -First 1 -ExpandProperty FullName"'

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L226

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

Findings

3 Critical15 High7 Medium4 Low

CriticalRemote Asset Decode Executedist/bundle/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/index.js

CriticalPrevious Version Dangerous Deltacomate-engine/node_modules/@comate/plugin-engine/dist/index.js

HighChild Processscripts/postinstall.js

HighShellscripts/postinstall.js

HighSame File Env Network Executioncomate-engine/assets/hooks/local-swe-task-reporter.js

HighCredential Redirect Persistencedist/bundle/index.js

HighCommand Output Exfiltrationcomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighSandbox Evasion Gated Capabilitydist/bundle/index.js

HighObfuscated Payload Loadercomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

Affected versions and remediation

This report applies to @comate/zulu@1.7.17.

See all versions of @comate/zulu for other recorded verdicts.

Review the evidence and your use of @comate/zulu@1.7.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 19:15:08.752Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.