@comate/zulu@1.7.19: Malicious npm security report (Block)

Loading npm security reports…

@comate/zulu@1.7.19: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

33 flagged

scripts/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// ripgrep 自举 postinstall。既服务 @comate/zulu，也被 build-tui.mjs 原样拷进 comatecli(TUI) 发布包。

3//

4// 解析优先级（与 src/utils/defaultRipgrep.ts 契约一致）：

5// 0. 系统 PATH 有 rg (>=12) → 直接用，零副作用（本脚本提前 return）

6// 1. bundle 内预置二进制 (策略B) → <包根>/ripgrep-binary/<target>/rg ← build 期随包 staging

7// 2. bundle 内 .rg-path 缓存 → 同次安装复用

8// 3. 家目录韧性缓存 → ~/.comate/ripgrep-binary/<target>/rg ← 跨重装/自更新存活，杜绝反复下载

9// 4. 下载（内网镜像优先→ghproxy→github）→ 落 3 的韧性缓存位置

10//

11// 纯逻辑（版本比较/平台映射/下载源生成）抽在 ./postinstallCore.mjs（可单测）。本文件只保留有副作用的编排，

12// 且 main() 以 import-guard 收口——被 `import` 时不自动执行，只有作为脚本被直接 node 执行才跑。

14import {execSync} from 'node:child_process';

15import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

16 existsSync,

17 mkdirSync,

18 rmSync,

19 writeFileSync,

20 readFileSync,

21 copyFileSync,

22 chmodSync,

23 realpathSync,

24 createWriteStream,

25} from 'node:fs';

26import {join, dirname} from 'node:path';

27import {homedir} from 'node:os';

28import {fileURLToPath} from 'node:url';

29import https from 'node:https';

30import http from 'node:http';

31import {

32 RIPGREP_VERSION,

33 MIN_RG_VERSION,

Lines 206-246javascript

206 await downloadWithNodeHttps(url, tmpFile);

207 }

208 if (existsSync(tmpFile)) {

209 console.error(`✓ 从 ${sourceName} 下载成功`);

210 return true;

211 }

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.16 matchedPath = scripts/postinstall.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

comate-engine/node_modules/win-ca/lib/hash.jsView file

Lines 1-28javascript

1// Generated by LiveScript 1.6.0

2var crypto, forge, der2, asn1, toASN1, bufferFrom;

3crypto = require('crypto');

4forge = require('./forge');

5der2 = require(

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView file

1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo... L2: /*!

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1

1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo... L2: /*! ... L7: */ L8: !function(e){var A=er,t=C.extname,i=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function r(e){if(!e||"string"!=typeof e)return!1;var t=i.exec(e),r=t&&A[t[1].toLowerCase()];return r&&r.c... L9: /*! ... L35: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let $_;P_.Settings=Z_.default,P_.stat=function(e,A,t){"function"!=typeof A?W_.read(e,X_(A),t... L36: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const AD="function"==typeof queueMicrotask?queueMicrotask.bind("undefined"!=typeof window?windo... L37: /** ... L4

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1

dist/bundle/index.jsView file

1Trigger-reachable chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*! ... L7: */ L8: !function(e){var t=mimeDb,r=require$$1__default.extname,n=/^\s*([^;\s]*)(?:;|\s|$)/,A=/^text\//i;function i(e){if(!e||"string"!=typeof e)return!1;var r=n.exec(e),i=r&&t[r[1].toLowe... L9: /*! ... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function ru

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bundle/index.js: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... !function(e){var t=mimeDb,r=require$$1__default.extname,n=/^\s*([^;\s]*)(?:;|\s|$)/,A=/^text\//i;function i(e){if(!e||"string"!=typeof e)return!1;var r=n.exec(e),i=r&&t[r[1].toLowe... */lodash$2.exports,function(e,t){(function(){var r,n="Expected a function",A="__lodash_hash_undefined__",i="__lodash_placeholder__",s=32,a=128,o=256,c=1/0,l=9007199254740991,g=NaN,... */var isExtendable=function(e){return null!=e&&("object"==typeof e||"

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bundle/index.js

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView file

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView file

•path = comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylib kind = native_binary sizeBytes = 161704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView on unpkg

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView file

•path = comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasm kind = wasm_module sizeBytes = 1358224 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView on unpkg

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.py kind = payload_in_excluded_dir sizeBytes = 3934 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView on unpkg

comate-engine/node_modules/@comate/plugin-host/dist/user-CAYijOXi.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.16 matchedPath = comate-engine/node_modules/@comate/plugin-host/dist/user-CAYijOXi.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/plugin-host/dist/user-CAYijOXi.jsView on unpkg

comate-engine/node_modules/@comate/plugin-shared-internals/dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.16 matchedPath = comate-engine/node_modules/@comate/plugin-shared-internals/dist/index.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/plugin-shared-internals/dist/index.jsView on unpkg

comate-engine/node_modules/@comate/preview-proxy/dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.16 matchedPath = comate-engine/node_modules/@comate/preview-proxy/dist/index.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/preview-proxy/dist/index.jsView on unpkg

comate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.16 matchedPath = comate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.jsView on unpkg

comate-engine/node_modules/@comate/plugin-host/dist/main.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.16 matchedPath = comate-engine/node_modules/@comate/plugin-host/dist/main.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/plugin-host/dist/main.jsView on unpkg

comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.16 matchedPath = comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjs matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjsView on unpkg

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.16 matchedPath = comate-engine/assets/hooks/local-swe-task-reporter.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/hooks/local-swe-task-reporter.jsView on unpkg

comate-engine/node_modules/web-tree-sitter/lib/tree-sitter.cjsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.16 matchedPath = comate-engine/node_modules/web-tree-sitter/lib/tree-sitter.cjs matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/web-tree-sitter/lib/tree-sitter.cjsView on unpkg

comate-engine/node_modules/web-tree-sitter/tree-sitter.cjsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.16 matchedPath = comate-engine/node_modules/web-tree-sitter/tree-sitter.cjs matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/web-tree-sitter/tree-sitter.cjsView on unpkg

Source & flagged code

33 flagged · loading source

scripts/postinstall.jsView file

13L14: import {execSync} from 'node:child_process'; L15: import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

226const findCmd = isWindows L227: ? `powershell -Command "Get-ChildItem -Path '${searchDir}' -Filter 'rg.exe' -Recurse ` + L228: '| Select-Object -First 1 -ExpandProperty FullName"'

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L226

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

comate-engine/node_modules/win-ca/lib/hash.jsView file

8module.exports = dispatch; L9: bufferFrom = Buffer.from || function(data, encoding){ L10: return new Buffer(data, encoding);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

comate-engine/node_modules/win-ca/lib/hash.jsView on unpkg · L8

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView file

1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo... L2: /*!

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1

dist/bundle/index.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bundle/index.js

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView file

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView file

•path = comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylib kind = native_binary sizeBytes = 161704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView on unpkg

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView file

•path = comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasm kind = wasm_module sizeBytes = 1358224 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView on unpkg

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.py kind = payload_in_excluded_dir sizeBytes = 3934 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView on unpkg

comate-engine/node_modules/@comate/plugin-host/dist/user-CAYijOXi.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/plugin-host/dist/user-CAYijOXi.jsView on unpkg

comate-engine/node_modules/@comate/plugin-shared-internals/dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/plugin-shared-internals/dist/index.jsView on unpkg

comate-engine/node_modules/@comate/preview-proxy/dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/preview-proxy/dist/index.jsView on unpkg

comate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.jsView on unpkg

comate-engine/node_modules/@comate/plugin-host/dist/main.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/plugin-host/dist/main.jsView on unpkg

comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjsView on unpkg

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/hooks/local-swe-task-reporter.jsView on unpkg

comate-engine/node_modules/web-tree-sitter/lib/tree-sitter.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/web-tree-sitter/lib/tree-sitter.cjsView on unpkg

comate-engine/node_modules/web-tree-sitter/tree-sitter.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/web-tree-sitter/tree-sitter.cjsView on unpkg

Findings

5 Critical23 High7 Medium4 Low

CriticalSame File Env Network Executioncomate-engine/node_modules/@comate/plugin-engine/dist/index.js

CriticalBrowser Credential Phishingcomate-engine/node_modules/@comate/plugin-engine/dist/index.js

CriticalDownload Executecomate-engine/node_modules/@comate/plugin-engine/dist/index.js

CriticalRemote Asset Decode Executecomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/index.js

HighChild Processscripts/postinstall.js

HighShellscripts/postinstall.js

HighCredential Redirect Persistencedist/bundle/index.js

HighCommand Output Exfiltrationcomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighSandbox Evasion Gated Capabilitycomate-engine/node_modules/@comate/plugin-engine/dist/index.js

HighObfuscated Payload Loadercomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighRemote Agent Bridgecomate-engine/node_modules/@comate/plugin-engine/dist/index.js

HighCross File Remote Execution Contextcomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighTrigger Reachable Command Output Exfiltrationdist/bundle/index.js

HighPayload In Excluded Dircomate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.py

HighSemantic Analysis Limitedcomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighKnown Malware Source Similaritycomate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js

HighKnown Malware Source Similaritycomate-engine/node_modules/@comate/plugin-engine/dist/index.js

HighKnown Malware Source Similaritycomate-engine/node_modules/@comate/plugin-host/dist/user-CAYijOXi.js

HighKnown Malware Source Similaritycomate-engine/node_modules/@comate/plugin-shared-internals/dist/index.js

HighKnown Malware Source Similaritycomate-engine/node_modules/@comate/preview-proxy/dist/index.js

HighKnown Malware Source Similaritycomate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.js

HighKnown Malware Source Similaritycomate-engine/node_modules/@comate/plugin-host/dist/main.js

HighKnown Malware Source Similarityscripts/postinstall.js

HighKnown Malware Source Similaritycomate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjs

HighKnown Malware Source Similaritycomate-engine/assets/hooks/local-swe-task-reporter.js

HighKnown Malware Source Similaritycomate-engine/node_modules/web-tree-sitter/lib/tree-sitter.cjs

HighKnown Malware Source Similaritycomate-engine/node_modules/web-tree-sitter/tree-sitter.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarycomate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylib

MediumShips Wasm Modulecomate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasm

MediumShips Build Helpercomate-engine/assets/skills/icode/scripts/common.sh

MediumOversized Source Filedist/bundle/index.js

MediumStructural Risk Force Deep Review

LowWeak Cryptocomate-engine/node_modules/win-ca/lib/hash.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

33 flagged

scripts/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// ripgrep 自举 postinstall。既服务 @comate/zulu，也被 build-tui.mjs 原样拷进 comatecli(TUI) 发布包。

3//

4// 解析优先级（与 src/utils/defaultRipgrep.ts 契约一致）：

5// 0. 系统 PATH 有 rg (>=12) → 直接用，零副作用（本脚本提前 return）

6// 1. bundle 内预置二进制 (策略B) → <包根>/ripgrep-binary/<target>/rg ← build 期随包 staging

7// 2. bundle 内 .rg-path 缓存 → 同次安装复用

8// 3. 家目录韧性缓存 → ~/.comate/ripgrep-binary/<target>/rg ← 跨重装/自更新存活，杜绝反复下载

9// 4. 下载（内网镜像优先→ghproxy→github）→ 落 3 的韧性缓存位置

10//

11// 纯逻辑（版本比较/平台映射/下载源生成）抽在 ./postinstallCore.mjs（可单测）。本文件只保留有副作用的编排，

12// 且 main() 以 import-guard 收口——被 `import` 时不自动执行，只有作为脚本被直接 node 执行才跑。

14import {execSync} from 'node:child_process';

15import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

16 existsSync,

17 mkdirSync,

18 rmSync,

19 writeFileSync,

20 readFileSync,

21 copyFileSync,

22 chmodSync,

23 realpathSync,

24 createWriteStream,

25} from 'node:fs';

26import {join, dirname} from 'node:path';

27import {homedir} from 'node:os';

28import {fileURLToPath} from 'node:url';

29import https from 'node:https';

30import http from 'node:http';

31import {

32 RIPGREP_VERSION,

33 MIN_RG_VERSION,

Lines 206-246javascript

206 await downloadWithNodeHttps(url, tmpFile);

207 }

208 if (existsSync(tmpFile)) {

209 console.error(`✓ 从 ${sourceName} 下载成功`);

210 return true;

211 }

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

comate-engine/node_modules/win-ca/lib/hash.jsView file

Lines 1-28javascript

1// Generated by LiveScript 1.6.0

2var crypto, forge, der2, asn1, toASN1, bufferFrom;

3crypto = require('crypto');

4forge = require('./forge');

5der2 = require(

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView file

1import e from"node:path";import A from"node:fs/promises";import t,{createWriteStream as i,createReadStream as n,realpathSync as r,statSync as a}from"node:fs";import o from"fs";impo... L2: /*!

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

comate-engine/node_modules/@comate/plugin-engine/dist/index.jsView on unpkg · L1

dist/bundle/index.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bundle/index.js

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView file

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"node:url";import{dirname as t}from"node:path";import{createRequire as n}from"node:module";const __dirname=t(e(import.meta.url)),require=n(import.meta...

High

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView file

•path = comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylib kind = native_binary sizeBytes = 161704 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

comate-engine/node_modules/sqlite-vec-darwin-arm64/vec0.dylibView on unpkg

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView file

•path = comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasm kind = wasm_module sizeBytes = 1358224 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

comate-engine/node_modules/tree-sitter-bash/tree-sitter-bash.wasmView on unpkg

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.py kind = payload_in_excluded_dir sizeBytes = 3934 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_source_text_guard.pyView on unpkg

comate-engine/node_modules/@comate/plugin-host/dist/user-CAYijOXi.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/plugin-host/dist/user-CAYijOXi.jsView on unpkg

comate-engine/node_modules/@comate/plugin-shared-internals/dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/plugin-shared-internals/dist/index.jsView on unpkg

comate-engine/node_modules/@comate/preview-proxy/dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/preview-proxy/dist/index.jsView on unpkg

comate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.jsView on unpkg

comate-engine/node_modules/@comate/plugin-host/dist/main.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/@comate/plugin-host/dist/main.jsView on unpkg

comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/skills/baidu-cloud-bos/scripts/bos_node.mjsView on unpkg

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/assets/hooks/local-swe-task-reporter.jsView on unpkg

comate-engine/node_modules/web-tree-sitter/lib/tree-sitter.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/web-tree-sitter/lib/tree-sitter.cjsView on unpkg

comate-engine/node_modules/web-tree-sitter/tree-sitter.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

comate-engine/node_modules/web-tree-sitter/tree-sitter.cjsView on unpkg

@comate/zulu@1.7.19

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code