registry / Install hook abuse / @comate/zulu / 1.7.20

@comate/zulu@1.7.20

AI Coding Agent

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a real automatic remote-binary execution surface with persistence in a user directory, but the inspected code is a transparent, package-aligned ripgrep bootstrapper rather than evidence of covert theft or a broader agent-control takeover.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package when an acceptable system ripgrep is unavailable.

Impact

A compromised configured mirror, proxy, or download source could cause execution of an attacker-controlled binary during installation.

Mechanism

Automatic download, extraction, execution, and caching of a ripgrep binary.

AI rationale

Evidence

package.jsonscripts/postinstall.jsscripts/postinstallCore.mjs~/.comate/ripgrep-binary/<target>/rg~/.comate/.rg-pathripgrep-binary/.rg-path

Network endpoints2

github.comghproxy.net

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package automatically runs a postinstall script.
When ripgrep is absent, the installer downloads an archive from a configurable mirror or proxy.
The installer extracts the archive and executes the downloaded binary before retaining it.
It persists the binary path under the user's .comate directory.

Evidence against

The installer first accepts an existing system ripgrep and exits without download.
The download targets a fixed ripgrep release and appears to support the package's code-search feature.
No self-dependency, credential collection, or data exfiltration was found in the inspected lifecycle source.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Source & flagged code

31 flagged

package.jsonView file

Lines 15-55json

15 "exports": {

16 ".": "./dist/bundle/index.js"

17 },

18 "optionalDependencies": {

19 "better-sqlite3": "12.4.1"

20 },

21 "engines": {

22 "node": ">=20.10.0"

23 },

24 "comate": {

25 "compatibilityPluginVersion": "4.13.0",

26 "engineCore": true

27 },

28 "files": [

29 "dist",

30 "bin",

31 "scripts",

32 "runtime-dependencies.json"

33 ],

34 "scripts": {

35 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 },

37 "dependencies": {

38 "exceljs": "4.4.0",

39 "mammoth": "1.12.0",

40 "pdfreader": "3.0.8",

41 "@baidu/comate-browser-use": "2.0.4",

42 "web-tree-sitter": "0.25.10",

43 "tree-sitter-bash": "0.25.1",

44 "sqlite-vec": "0.1.7-alpha.2"

45 },

46 "bundledDependencies": [

47 "exceljs",

48 "mammoth",

49 "pdfreader",

50 "@baidu/comate-browser-use",

51 "web-tree-sitter",

52 "tree-sitter-bash",

53 "sqlite-vec"

54 ]

55}

dist/bundle/index.jsView file

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

High

Child Process

Package source references child process execution.

dist/bundle/index.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bundle/index.js: import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bundle/index.jsView on unpkg

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bundle/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

scripts/postinstall.jsView file

Lines 206-246javascript

206 await downloadWithNodeHttps(url, tmpFile);

207 }

208 if (existsSync(tmpFile)) {

209 console.error(`✓ 从 ${sourceName} 下载成功`);

210 return true

dist/bundle/chunk-BxSUiYhP.jsView file

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";t(e(import.meta.url));import{fileURLToPath as n}from"node:url";import{dirname as r}from"node:path";import{createR...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle/chunk-BxSUiYhP.jsView on unpkg · L1

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";t(e(import.meta.url));import{fileURLToPath as n}from"node:url";import{dirname as r}from"node:path";import{createR...

High

Eval

Package source references dynamic code evaluation.

dist/bundle/chunk-BxSUiYhP.jsView on unpkg · L1

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";t(e(import.meta.url));import{fileURLToPath as n}from"node:url";import{dirname as r}from"node:path";import{createR...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/bundle/chunk-BxSUiYhP.jsView on unpkg · L1

1Cross-file remote execution chain: dist/bundle/chunk-BxSUiYhP.js spawns dist/bundle/index.js; helper contains network access plus dynamic code execution. L1: import{fileURLToPath as e}from"url";import{dirname as t}from"path";t(e(import.meta.url));import{fileURLToPath as n}from"node:url";import{dirname as r}from"node:path";import{createR...

dist/bundle/chunk-Ch_-rog1.jsView file

1import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as path$... L2: /*!

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/bundle/chunk-Ch_-rog1.jsView on unpkg · L1

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/bundle/chunk-Ch_-rog1.jsView on unpkg · L1

1import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as path$... L2: /*! ... L7: */ L8: !function(e){var t=mimeDb,r=path__default.extname,n=/^\s*([^;\s]*)(?:;|\s|$)/,i=/^text\//i;function s(e){if(!e||"string"!=typeof e)return!1;var r=n.exec(e),s=r&&t[r[1].toLowerCase(... L9: /*! ... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out$1.Settings=settings_1$3.default,out$1.stat=stat$4,out$1.statSync=statSync;va... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let r,n,i,s=!0;function o(e){... L36: /** ... L4

node_modules/tree-sitter-bash/prebuilds/win32-arm64/tree-sitter-bash.nodeView file

•path = node_modules/tree-sitter-bash/prebuilds/win32-arm64/tree-sitter-bash.node kind = native_binary sizeBytes = 1524736 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node_modules/tree-sitter-bash/prebuilds/win32-arm64/tree-sitter-bash.nodeView on unpkg

node_modules/tree-sitter-bash/tree-sitter-bash.wasmView file

•path = node_modules/tree-sitter-bash/tree-sitter-bash.wasm kind = wasm_module sizeBytes = 1358224 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/tree-sitter-bash/tree-sitter-bash.wasmView on unpkg

node_modules/tree-sitter-bash/binding.gypView file

•path = node_modules/tree-sitter-bash/binding.gyp kind = build_helper sizeBytes = 599 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

node_modules/tree-sitter-bash/binding.gypView on unpkg

node_modules/mammoth/test/test-data/tables.docxView file

•path = node_modules/mammoth/test/test-data/tables.docx kind = payload_in_excluded_dir sizeBytes = 13087 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

node_modules/mammoth/test/test-data/tables.docxView on unpkg

•path = node_modules/mammoth/test/test-data/tables.docx kind = compressed_blob sizeBytes = 13087 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

node_modules/mammoth/test/test-data/tables.docxView on unpkg

•path = node_modules/mammoth/test/test-data/tables.docx kind = nested_archive_needs_inspection sizeBytes = 13087 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

node_modules/mammoth/test/test-data/tables.docxView on unpkg

node_modules/mammoth/test/test-data/endnotes.docxView file

•path = node_modules/mammoth/test/test-data/endnotes.docx kind = high_entropy_blob sizeBytes = 4431 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

node_modules/mammoth/test/test-data/endnotes.docxView on unpkg

node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.19 matchedPath = comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg

node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.19 matchedPath = comate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.jsView on unpkg

Source & flagged code

31 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bundle/index.jsView file

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

High

Child Process

Package source references child process execution.

dist/bundle/index.jsView on unpkg · L1

Findings

7 Critical15 High10 Medium6 Low

CriticalSame File Env Network Executiondist/bundle/chunk-Ch_-rog1.js

CriticalCommand Output Exfiltrationdist/bundle/chunk-Ch_-rog1.js

CriticalBrowser Credential Phishingdist/bundle/chunk-Ch_-rog1.js

CriticalDownload Executedist/bundle/chunk-Ch_-rog1.js

CriticalRemote Asset Decode Executedist/bundle/chunk-BxSUiYhP.js

CriticalRemote Response Code Executiondist/bundle/chunk-Ch_-rog1.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/chunk-Ch_-rog1.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/bundle/index.js

HighShellscripts/postinstall.js

HighEvaldist/bundle/chunk-BxSUiYhP.js

Affected versions and remediation

This report applies to @comate/zulu@1.7.20.

See all versions of @comate/zulu for other recorded verdicts.

Review the evidence and your use of @comate/zulu@1.7.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-17 10:00:26.443Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.