@comate/zulu@1.7.18

AI Coding Agent

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No npm lifecycle script executes on installation, so the evidence does not establish install-hook abuse. The automatic agent hooks and unchecked skill binary update are concrete runtime risks requiring a warning.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Starting the Comate agent with built-in hooks enabled, then using a command tool for a git push; separately, invoking the ku skill.

Impact

Repository and commit metadata can leave the machine, and a remote binary can run under the invoking user.

Mechanism

Agent hook telemetry and unchecked remote binary update.

AI rationale

Evidence

comate-engine/assets/hooks/hooks.builtin.jsoncomate-engine/assets/hooks/local-swe-task-reporter.jscomate-engine/assets/skills/ku-doc-manage/bin/ku~/.comate/builtin-hook-state

Network endpoints2

10.11.157.60:8301/api/v1/local-swe/tasksmorpho.bj.bcebos.com/soqa-debug

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Built-in agent hooks invoke a command reporter before and after command-tool use.
The reporter sends repository, branch, commit, and review URL data to an internal network service after matching a push.
A bundled knowledge-base wrapper downloads and executes a platform binary without an integrity check.

Evidence against

The published manifest has no preinstall, install, or postinstall lifecycle hook.
The reporter is a built-in Comate hook asset, not an npm install hook.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 716 KB of source, external domains: 10.11.157.60, github.com

Oversized source lightweight scan

Source & flagged code

22 flagged

scripts/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// ripgrep 自举 postinstall。既服务 @comate/zulu，也被 build-tui.mjs 原样拷进 comatecli(TUI) 发布包。

3//

4// 解析优先级（与 src/utils/defaultRipgrep.ts 契约一致）：

5// 0. 系统 PATH 有 rg (>=12) → 直接用，零副作用（本脚本提前 return）

6// 1. bundle 内预置二进制 (策略B) → <包根>/ripgrep-binary/<target>/rg ← build 期随包 staging

7// 2. bundle 内 .rg-path 缓存 → 同次安装复用

8// 3. 家目录韧性缓存 → ~/.comate/ripgrep-binary/<target>/rg ← 跨重装/自更新存活，杜绝反复下载

9// 4. 下载（内网镜像优先→ghproxy→github）→ 落 3 的韧性缓存位置

10//

11// 纯逻辑（版本比较/平台映射/下载源生成）抽在 ./postinstallCore.mjs（可单测）。本文件只保留有副作用的编排，

12// 且 main() 以 import-guard 收口——被 `import` 时不自动执行，只有作为脚本被直接 node 执行才跑。

14import {execSync} from 'node:child_process';

15import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

16 existsSync,

17 mkdirSync,

18 rmSync,

19 writeFileSync,

20 readFileSync,

21 copyFileSync,

22 chmodSync,

23 realpathSync,

24 createWriteStream,

25} from 'node:fs';

26import {join, dirname} from 'node:path';

27import {homedir} from 'node:os';

28import {fileURLToPath} from 'node:url';

29import https from 'node:https';

30import http from 'node:http';

31import {

32 RIPGREP_VERSION,

33 MIN_RG_VERSION,

Lines 206-246javascript

206 await downloadWithNodeHttps(url, tmpFile);

207 }

208 if (existsSync(tmpFile)) {

209 console.error(`✓ 从 ${sourceName} 下载成功`);

210 return true;

211 }

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.15 matchedPath = scripts/postinstall.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

comate-engine/node_modules/win-ca/lib/hash.jsView file

Lines 1-28javascript

1// Generated by LiveScript 1.6.0

2var crypto, forge, der2, asn1, toASN1, bufferFrom;

3crypto = require('crypto');

4forge = require('./forge');

5der2 = require(

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2'use strict';

4import crypto from 'node:crypto';

5import fs from 'node:fs';

6import http from 'node:http'

dist/bundle/index.jsView file

32* Licensed under the MIT License. L33: */const util$3=require$$0$5,toRegexRange=toRegexRange_1,isObject$6=e=>null!==e&&"object"==typeof e&&!Array.isArray(e),transform=e=>t=>!0===e?Number(t):String(t),isValidValue=e=>"nu... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let r,n,A,i=!0;function s(e){... L36: /** ... L42: * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors L43: */lodash$2.exports,function(e,t){(function(){var r,n="Expected a function",A="__lodash_has

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle/index.jsView on unpkg · L32

1Trigger-reachable chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*!

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @comate/zulu@1.7.17 matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.17 similarity = 0.990 summary = stored previous version shares package body but lacks this dangerous source file

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView file

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView file

•path = comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylib kind = native_binary sizeBytes = 161704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView on unpkg

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView file

•path = comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasm kind = wasm_module sizeBytes = 1358224 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView on unpkg

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.py kind = payload_in_excluded_dir sizeBytes = 3934 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView on unpkg

comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.15 matchedPath = comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjs matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjsView on unpkg

comate-engine/assets/skills/ku-doc-manage/bin/kuView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.15 matchedPath = comate-engine/assets/skills/ku-doc-manage/bin/ku matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/skills/ku-doc-manage/bin/kuView on unpkg

Source & flagged code

22 flagged · loading source

scripts/postinstall.jsView file

13L14: import {execSync} from 'node:child_process'; L15: import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

226const findCmd = isWindows L227: ? `powershell -Command "Get-ChildItem -Path '${searchDir}' -Filter 'rg.exe' -Recurse ` + L228: '| Select-Object -First 1 -ExpandProperty FullName"'

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L226

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

Findings

3 Critical14 High7 Medium4 Low

CriticalRemote Asset Decode Executedist/bundle/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/index.js

CriticalPrevious Version Dangerous Deltadist/bundle/index.js

HighChild Processscripts/postinstall.js

HighShellscripts/postinstall.js

HighSame File Env Network Executioncomate-engine/assets/hooks/local-swe-task-reporter.js

HighCredential Redirect Persistencedist/bundle/index.js

HighCommand Output Exfiltrationcomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighSandbox Evasion Gated Capabilitydist/bundle/index.js

HighObfuscated Payload Loadercomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

Affected versions and remediation

This report applies to @comate/zulu@1.7.18.

See all versions of @comate/zulu for other recorded verdicts.

Review the evidence and your use of @comate/zulu@1.7.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-09 09:46:26.892Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.