registry / @comate/zulu / 1.7.3

@comate/zulu@1.7.3

AI Coding Agent

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Network, subprocess, and update functionality are CLI runtime features rather than install-time execution.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Explicit zulu CLI invocation

Impact

No unconsented install-time mutation, payload execution, or exfiltration established

Mechanism

AI coding CLI with optional self-update and service communication

Rationale

Direct inspection found no lifecycle hook and no concrete remote decode-and-execute chain. The scanner’s eval signal is attributable to bundled parser code, while update behavior is package-aligned CLI functionality.

Evidence

package.jsonbin/cli.mjsdist/bundle/index.jsscripts/postinstall.js

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/bundle/index.js includes CLI update/install and subprocess capabilities, but they are runtime features.
The only eval matches inspected are bundled config-parser support, not downloaded payload execution.

Evidence against

package.json has no npm lifecycle scripts.
bin/cli.mjs only imports and calls the exported run() CLI entrypoint.
dist/bundle/index.js exports run; inspected run() initializes CLI and processes explicit arguments.
Update code validates versions/registries and invokes npm only for package self-update.
scripts/postinstall.js is present but unreferenced by package.json.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

14 flagged

scripts/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// ripgrep 自举 postinstall。既服务 @comate/zulu，也被 build-tui.mjs 原样拷进 comatecli(TUI) 发布包。

3//

4// 解析优先级（与 src/utils/defaultRipgrep.ts 契约一致）：

5// 0. 系统 PATH 有 rg (>=12) → 直接用，零副作用（本脚本提前 return）

6// 1. bundle 内预置二进制 (策略B) → <包根>/ripgrep-binary/<target>/rg ← build 期随包 staging

7// 2. bundle 内 .rg-path 缓存 → 同次安装复用

8// 3. 家目录韧性缓存 → ~/.comate/ripgrep-binary/<target>/rg ← 跨重装/自更新存活，杜绝反复下载

9// 4. 下载（内网镜像优先→ghproxy→github）→ 落 3 的韧性缓存位置

10//

11// 纯逻辑（版本比较/平台映射/下载源生成）抽在 ./postinstallCore.mjs（可单测）。本文件只保留有副作用的编排，

12// 且 main() 以 import-guard 收口——被 `import` 时不自动执行，只有作为脚本被直接 node 执行才跑。

14import {execSync} from 'node:child_process';

15import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

16 existsSync,

17 mkdirSync,

18 rmSync,

19 writeFileSync,

20 readFileSync,

21 copyFileSync,

22 chmodSync,

23 realpathSync,

24 createWriteStream,

25} from 'node:fs';

26import {join, dirname} from 'node:path';

27import {homedir} from 'node:os';

28import {fileURLToPath} from 'node:url';

29import https from 'node:https';

30import http from 'node:http';

31import {

32 RIPGREP_VERSION,

33 MIN_RG_VERSION,

Lines 206-246javascript

206 await downloadWithNodeHttps(url, tmpFile);

207 }

208 if (existsSync(tmpFile)) {

209 console.error(`✓ 从 ${sourceName} 下载成功`);

210 return true;

211 }

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2'use strict';

4import crypto from 'node:crypto';

5import fs from 'node:fs';

6import http from 'node:http'

dist/bundle/index.jsView file

32* Licensed under the MIT License. L33: */const util$3=require$$0$5,toRegexRange=toRegexRange_1,isObject$6=e=>null!==e&&"object"==typeof e&&!Array.isArray(e),transform=e=>t=>!0===e?Number(t):String(t),isValidValue=e=>"nu... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let A,r,n,i=!0;function s(e){... L36: /** ... L42: * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors L43: */lodash$2.exports,function(e,t){(function(){var A,r="Expected a function",n="__lodash_has

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle/index.jsView on unpkg · L32

1Trigger-reachable chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*!

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @comate/zulu@1.7.1 matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.1 similarity = 0.957 summary = stored previous version shares package body but lacks this dangerous source file

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.py kind = payload_in_excluded_dir sizeBytes = 1118 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.pyView on unpkg

Source & flagged code

14 flagged · loading source

scripts/postinstall.jsView file

13L14: import {execSync} from 'node:child_process'; L15: import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

226const findCmd = isWindows L227: ? `powershell -Command "Get-ChildItem -Path '${searchDir}' -Filter 'rg.exe' -Recurse ` + L228: '| Select-Object -First 1 -ExpandProperty FullName"'

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L226

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

5import fs from 'node:fs'; L6: import http from 'node:http'; L7: import https from 'node:https'; ... L9: import path from 'node:path'; L10: import {execFileSync} from 'node:child_process'; L11: L12: const STATE_ROOT = L13: process.env.COMATE_BUILTIN_HOOK_STATE_DIR || path.join(os.homedir(), '.comate', 'builtin-hook-state'); L14: const STATE_DIR = path.join(STATE_ROOT, 'local-swe-task');

Findings

3 Critical9 High5 Medium4 Low

CriticalRemote Asset Decode Executedist/bundle/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/index.js

CriticalPrevious Version Dangerous Deltadist/bundle/index.js

HighChild Processscripts/postinstall.js

HighShellscripts/postinstall.js

HighSame File Env Network Executioncomate-engine/assets/hooks/local-swe-task-reporter.js

HighCommand Output Exfiltrationdist/bundle/index.js

HighSandbox Evasion Gated Capabilitydist/bundle/index.js

HighObfuscated Payload Loaderdist/bundle/index.js

HighTrigger Reachable Command Output Exfiltrationdist/bundle/index.js

HighPayload In Excluded Dir