registry / Remote code execution / @comate/zulu / 1.7.21

@comate/zulu@1.7.21

AI Coding Agent

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a concrete, conditional install-time remote-binary execution path with an unrestricted configured mirror. The code appears aimed at installing ripgrep, but the lack of a shown integrity binding leaves a material supply-chain risk.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the declared postinstall hook when no acceptable local ripgrep binary is available.

Impact

A party able to control the configured mirror can supply code executed during installation; the hook does not show a cryptographic integrity check.

Mechanism

The hook constructs download URLs from RIPGREP_MIRROR_BASE, extracts the archive, then executes the selected binary for its version check.

AI rationale

Evidence

package.jsonscripts/postinstall.jsscripts/postinstallCore.mjs

Network endpoints2

github.com/BurntSushi/ripgrep/releases/download/${version}/${filename}ghproxy.net/${githubUrl}

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package declares an automatic postinstall hook.
The hook permits an environment-configured mirror before its fallback download sources.
The hook extracts the downloaded archive, makes the binary executable, and runs it during installation.

Evidence against

A suitable system ripgrep binary causes the installer to return before downloading.
The built-in fallback URLs target ripgrep’s GitHub release and a proxy.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 4.12 MB of source, external domains: 10.11.152.208, 10.11.157.60, 127.0.0.1, cdn.playwright.dev, cloud.langfuse.com, comate-test.now.baidu-int.com, comate.baidu-int.com, comate.baidu.com, comate.now.baidu-int.com, console.cloud.baidu-int.com, cs.baidu-int.com, dmc.baidu-int.com, dotenvx.com, edgeupdates.microsoft.com, ghproxy.net, github.com, oneapi-comate.baidu-int.com, playwright.download.prss.microsoft.com, registry.npm.baidu-int.com, registry.npmjs.org, support.microsoft.com, www.w3.org

Source & flagged code

30 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bundle/index.jsView file

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

High

Child Process

Package source references child process execution.

dist/bundle/index.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bundle/index.js: import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bundle/index.jsView on unpkg

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bundle/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bundle/index.jsView on unpkg · L1

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/bundle/index.jsView on unpkg · L1

dist/bundle/chunk-Axq3Tabd.jsView file

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";t(e(import.meta.url));import{fileURLToPath as r}from"node:url";import n,{dirname as i}from"node:path";import{crea...

High

Shell

Package source references shell execution.

dist/bundle/chunk-Axq3Tabd.jsView on unpkg · L1

dist/bundle/chunk-BxSUiYhP.jsView file

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";t(e(import.meta.url));import{fileURLToPath as n}from"node:url";import{dirname as r}from"node:path";import{createR...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle/chunk-BxSUiYhP.jsView on unpkg · L1

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";t(e(import.meta.url));import{fileURLToPath as n}from"node:url";import{dirname as r}from"node:path";import{createR...

High

Eval

Package source references dynamic code evaluation.

dist/bundle/chunk-BxSUiYhP.jsView on unpkg · L1

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";t(e(import.meta.url));import{fileURLToPath as n}from"node:url";import{dirname as r}from"node:path";import{createR...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/bundle/chunk-BxSUiYhP.jsView on unpkg · L1

dist/bundle/chunk-BmwAFCfc.jsView file

1import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as path$... L2: /*!

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/bundle/chunk-BmwAFCfc.jsView on unpkg · L1

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/bundle/chunk-BmwAFCfc.jsView on unpkg · L1

1import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as path$... L2: /*! ... L7: */ L8: !function(e){var t=mimeDb,r=path__default.extname,n=/^\s*([^;\s]*)(?:;|\s|$)/,i=/^text\//i;function s(e){if(!e||"string"!=typeof e)return!1;var r=n.exec(e),s=r&&t[r[1].toLowerCase(... L9: /*! ... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out$1.Settings=settings_1$3.default,out$1.stat=stat$4,out$1.statSync=statSync;va... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let r,n,i,s=!0;function o(e){... L36: /** ... L4

node_modules/tree-sitter-bash/prebuilds/win32-arm64/tree-sitter-bash.nodeView file

•path = node_modules/tree-sitter-bash/prebuilds/win32-arm64/tree-sitter-bash.node kind = native_binary sizeBytes = 1524736 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node_modules/tree-sitter-bash/prebuilds/win32-arm64/tree-sitter-bash.nodeView on unpkg

node_modules/tree-sitter-bash/tree-sitter-bash.wasmView file

•path = node_modules/tree-sitter-bash/tree-sitter-bash.wasm kind = wasm_module sizeBytes = 1358224 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/tree-sitter-bash/tree-sitter-bash.wasmView on unpkg

node_modules/tree-sitter-bash/binding.gypView file

•path = node_modules/tree-sitter-bash/binding.gyp kind = build_helper sizeBytes = 599 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

node_modules/tree-sitter-bash/binding.gypView on unpkg

node_modules/mammoth/test/test-data/tables.docxView file

•path = node_modules/mammoth/test/test-data/tables.docx kind = payload_in_excluded_dir sizeBytes = 13087 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

node_modules/mammoth/test/test-data/tables.docxView on unpkg

•path = node_modules/mammoth/test/test-data/tables.docx kind = compressed_blob sizeBytes = 13087 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

node_modules/mammoth/test/test-data/tables.docxView on unpkg

•path = node_modules/mammoth/test/test-data/tables.docx kind = nested_archive_needs_inspection sizeBytes = 13087 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

node_modules/mammoth/test/test-data/tables.docxView on unpkg

node_modules/mammoth/test/test-data/endnotes.docxView file

•path = node_modules/mammoth/test/test-data/endnotes.docx kind = high_entropy_blob sizeBytes = 4431 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

node_modules/mammoth/test/test-data/endnotes.docxView on unpkg

node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.19 matchedPath = comate-engine/node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@baidu/comate-browser-use/dist/launch-chrome/index.jsView on unpkg

node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.19 matchedPath = comate-engine/node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@baidu/comate-browser-use/dist/adapter-chrome/index.jsView on unpkg

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @comate/zulu@1.7.19 matchedPath = scripts/postinstall.js matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

30 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bundle/index.jsView file

1import{fileURLToPath as e}from"url";import{dirname as t}from"path";const n=t(e(import.meta.url));import{a6 as s,a5 as r,T as i,B as o,ad as a,F as c,E as l,H as u,u as d,j as h,R a...

High

Child Process

Package source references child process execution.

dist/bundle/index.jsView on unpkg · L1

Findings

7 Critical15 High9 Medium6 Low

CriticalSame File Env Network Executiondist/bundle/chunk-BmwAFCfc.js

CriticalCommand Output Exfiltrationdist/bundle/chunk-BmwAFCfc.js

CriticalBrowser Credential Phishingdist/bundle/chunk-BmwAFCfc.js

CriticalDownload Executedist/bundle/chunk-BmwAFCfc.js

CriticalRemote Asset Decode Executedist/bundle/chunk-BxSUiYhP.js

CriticalRemote Response Code Executiondist/bundle/chunk-BmwAFCfc.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/chunk-BmwAFCfc.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/bundle/index.js

HighShelldist/bundle/chunk-Axq3Tabd.js

HighEvaldist/bundle/chunk-BxSUiYhP.js

Affected versions and remediation

This report applies to @comate/zulu@1.7.21.

See all versions of @comate/zulu for other recorded verdicts.

Review the evidence and your use of @comate/zulu@1.7.21 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 12:44:44.622Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.