registry / @comate/zulu / 1.7.7

@comate/zulu@1.7.7

AI Coding Agent

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI can fetch optional skills only through an explicit user command and stores them in its own Comate directory.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs the zulu CLI, particularly its skill-install command.

Impact

User-selected ZIP content may be installed as a Comate skill; no install-time execution or credential exfiltration was confirmed.

Mechanism

explicit CLI skill download and extraction

Rationale

This is a user-invoked AI coding CLI with expected network and local-agent integration behavior, not an install-time payload. Scanner claims of decoded remote execution and credential redirection were not substantiated by inspected source.

Evidence

package.jsonbin/cli.mjsdist/bundle/index.jscomate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.py~/.comate/skills~/.claude/ide

Network endpoints1

mcp-proxy.baidu-int.com

Decision evidence

public snapshot

AI called this Clean at 87.0% confidence as Benign with medium false-positive risk.

Evidence for block

User-invoked skill command accepts a remote ZIP URL and extracts it under ~/.comate/skills.
Named-skill downloads use the package-aligned Baidu MCP proxy.

Evidence against

package.json has bin/main exports but no lifecycle scripts.
CLI entrypoint only imports and invokes run() when the zulu command is executed.
No confirmed remote decode-and-execute chain was found; eval/new Function hits are bundled dependencies.
The flagged Python test is ordinary language-detector unit-test source.
The .claude path is used to discover IDE lock files, not to write agent configuration.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 715 KB of source, external domains: 10.11.157.60, github.com

Source & flagged code

16 flagged

scripts/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// ripgrep 自举 postinstall。既服务 @comate/zulu，也被 build-tui.mjs 原样拷进 comatecli(TUI) 发布包。

3//

4// 解析优先级（与 src/utils/defaultRipgrep.ts 契约一致）：

5// 0. 系统 PATH 有 rg (>=12) → 直接用，零副作用（本脚本提前 return）

6// 1. bundle 内预置二进制 (策略B) → <包根>/ripgrep-binary/<target>/rg ← build 期随包 staging

7// 2. bundle 内 .rg-path 缓存 → 同次安装复用

8// 3. 家目录韧性缓存 → ~/.comate/ripgrep-binary/<target>/rg ← 跨重装/自更新存活，杜绝反复下载

9// 4. 下载（内网镜像优先→ghproxy→github）→ 落 3 的韧性缓存位置

10//

11// 纯逻辑（版本比较/平台映射/下载源生成）抽在 ./postinstallCore.mjs（可单测）。本文件只保留有副作用的编排，

12// 且 main() 以 import-guard 收口——被 `import` 时不自动执行，只有作为脚本被直接 node 执行才跑。

14import {execSync} from 'node:child_process';

15import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

16 existsSync,

17 mkdirSync,

18 rmSync,

19 writeFileSync,

20 readFileSync,

21 copyFileSync,

22 chmodSync,

23 realpathSync,

24 createWriteStream,

25} from 'node:fs';

26import {join, dirname} from 'node:path';

27import {homedir} from 'node:os';

28import {fileURLToPath} from 'node:url';

29import https from 'node:https';

30import http from 'node:http';

31import {

32 RIPGREP_VERSION,

33 MIN_RG_VERSION,

Lines 206-246javascript

206 await downloadWithNodeHttps(url, tmpFile);

207 }

208 if (existsSync(tmpFile)) {

209 console.error(`✓ 从 ${sourceName} 下载成功`);

210 return true;

211 }

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2'use strict';

4import crypto from 'node:crypto';

5import fs from 'node:fs';

6import http from 'node:http'

dist/bundle/index.jsView file

32* Licensed under the MIT License. L33: */const util$3=require$$0$5,toRegexRange=toRegexRange_1,isObject$6=e=>null!==e&&"object"==typeof e&&!Array.isArray(e),transform=e=>t=>!0===e?Number(t):String(t),isValidValue=e=>"nu... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let A,r,n,i=!0;function s(e){... L36: /** ... L42: * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors L43: */lodash$2.exports,function(e,t){(function(){var A,r="Expected a function",n="__lodash_has

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle/index.jsView on unpkg · L32

1Trigger-reachable chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*!

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @comate/zulu@1.7.4 matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.7.4 similarity = 0.957 summary = stored previous version shares package body but lacks this dangerous source file

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.py kind = payload_in_excluded_dir sizeBytes = 1118 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.pyView on unpkg

Source & flagged code

16 flagged · loading source

scripts/postinstall.jsView file

13L14: import {execSync} from 'node:child_process'; L15: import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

226const findCmd = isWindows L227: ? `powershell -Command "Get-ChildItem -Path '${searchDir}' -Filter 'rg.exe' -Recurse ` + L228: '| Select-Object -First 1 -ExpandProperty FullName"'

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L226

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

5import fs from 'node:fs'; L6: import http from 'node:http'; L7: import https from 'node:https'; ... L9: import path from 'node:path'; L10: import {execFileSync} from 'node:child_process'; L11: L12: const STATE_ROOT = L13: process.env.COMATE_BUILTIN_HOOK_STATE_DIR || path.join(os.homedir(), '.comate', 'builtin-hook-state'); L14: const STATE_DIR = path.join(STATE_ROOT, 'local-swe-task');

Findings

3 Critical11 High5 Medium3 Low

CriticalRemote Asset Decode Executedist/bundle/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/index.js

CriticalPrevious Version Dangerous Deltadist/bundle/index.js

HighChild Processscripts/postinstall.js

HighShellscripts/postinstall.js

HighSame File Env Network Executioncomate-engine/assets/hooks/local-swe-task-reporter.js

HighCredential Redirect Persistencedist/bundle/index.js

HighEntrypoint Foreign Package Code Overwritedist/bundle/index.js

HighCommand Output Exfiltrationdist/bundle/index.js

HighSandbox Evasion Gated Capabilitydist/bundle/index.js

HighObfuscated Payload Loader