registry / @comate/zulu / 1.7.8

@comate/zulu@1.7.8

AI Coding Agent

AI Security Review

scanned 14d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a user-invoked AI coding CLI with package-aligned service endpoints and no lifecycle hook.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit zulu CLI execution.

Impact

Normal agent functionality; no confirmed unconsented install-time mutation or exfiltration.

Mechanism

Imports bundled AI-agent runtime and contacts Comate services.

Rationale

Direct inspection found no manifest lifecycle execution and no concrete malicious chain. Scanner findings are explained by a large bundled agent runtime and unused bootstrap script.

Evidence

package.jsonbin/cli.mjsdist/bundle/index.jsscripts/postinstall.js

Network endpoints4

comate.baidu.comcomate.baidu-int.comcomate-external-test.now.baidu.comcomate-test.now.baidu-int.com

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with medium false-positive risk.

Evidence for block

CLI execution explicitly imports and calls the bundled run() entrypoint.
Bundled client declares Comate service endpoints for its AI-agent functionality.
Bundled eval/New Function matches YAML parser support, not a remote decoded-payload execution chain.

Evidence against

package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
No confirmed credential theft, foreign-package overwrite, or AI-agent control-surface mutation was found.
The standalone ripgrep bootstrap script is not referenced by the package manifest.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 715 KB of source, external domains: 10.11.157.60, github.com

Source & flagged code

15 flagged

scripts/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// ripgrep 自举 postinstall。既服务 @comate/zulu，也被 build-tui.mjs 原样拷进 comatecli(TUI) 发布包。

3//

4// 解析优先级（与 src/utils/defaultRipgrep.ts 契约一致）：

5// 0. 系统 PATH 有 rg (>=12) → 直接用，零副作用（本脚本提前 return）

6// 1. bundle 内预置二进制 (策略B) → <包根>/ripgrep-binary/<target>/rg ← build 期随包 staging

7// 2. bundle 内 .rg-path 缓存 → 同次安装复用

8// 3. 家目录韧性缓存 → ~/.comate/ripgrep-binary/<target>/rg ← 跨重装/自更新存活，杜绝反复下载

9// 4. 下载（内网镜像优先→ghproxy→github）→ 落 3 的韧性缓存位置

10//

11// 纯逻辑（版本比较/平台映射/下载源生成）抽在 ./postinstallCore.mjs（可单测）。本文件只保留有副作用的编排，

12// 且 main() 以 import-guard 收口——被 `import` 时不自动执行，只有作为脚本被直接 node 执行才跑。

14import {execSync} from 'node:child_process';

15import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

16 existsSync,

17 mkdirSync,

18 rmSync,

19 writeFileSync,

20 readFileSync,

21 copyFileSync,

22 chmodSync,

23 realpathSync,

24 createWriteStream,

25} from 'node:fs';

26import {join, dirname} from 'node:path';

27import {homedir} from 'node:os';

28import {fileURLToPath} from 'node:url';

29import https from 'node:https';

30import http from 'node:http';

31import {

32 RIPGREP_VERSION,

33 MIN_RG_VERSION,

Lines 206-246javascript

206 await downloadWithNodeHttps(url, tmpFile);

207 }

208 if (existsSync(tmpFile)) {

209 console.error(`✓ 从 ${sourceName} 下载成功`);

210 return true;

211 }

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2'use strict';

4import crypto from 'node:crypto';

5import fs from 'node:fs';

6import http from 'node:http'

dist/bundle/index.jsView file

32* Licensed under the MIT License. L33: */const util$3=require$$0$5,toRegexRange=toRegexRange_1,isObject$6=e=>null!==e&&"object"==typeof e&&!Array.isArray(e),transform=e=>t=>!0===e?Number(t):String(t),isValidValue=e=>"nu... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let A,r,n,i=!0;function s(e){... L36: /** ... L42: * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors L43: */lodash$2.exports,function(e,t){(function(){var A,r="Expected a function",n="__lodash_has

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle/index.jsView on unpkg · L32

1Trigger-reachable chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*!

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bundle/index.js: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... !function(e){var t=mimeDb,A=require$$1__default.extname,r=/^\s*([^;\s]*)(?:;|\s|$)/,n=/^text\//i;function i(e){if(!e||"string"!=typeof e)return!1;var A=r.exec(e),i=A&&t[A[1].toLowe... */lodash$2.exports,function(e,t){(function(){var A,r="Expected a function",n="__lodash_hash_undefined__",i="__lodash_placeholder__",s=32,a=128,o=256,c=1/0,l=9007199254740991,g=NaN,... */var isExtendable=function(e){return null!=e&&("object"==typeof e||"

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.py kind = payload_in_excluded_dir sizeBytes = 1118 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.pyView on unpkg

Source & flagged code

15 flagged · loading source

scripts/postinstall.jsView file

13L14: import {execSync} from 'node:child_process'; L15: import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

226const findCmd = isWindows L227: ? `powershell -Command "Get-ChildItem -Path '${searchDir}' -Filter 'rg.exe' -Recurse ` + L228: '| Select-Object -First 1 -ExpandProperty FullName"'

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L226

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

5import fs from 'node:fs'; L6: import http from 'node:http'; L7: import https from 'node:https'; ... L9: import path from 'node:path'; L10: import {execFileSync} from 'node:child_process'; L11: L12: const STATE_ROOT = L13: process.env.COMATE_BUILTIN_HOOK_STATE_DIR || path.join(os.homedir(), '.comate', 'builtin-hook-state'); L14: const STATE_DIR = path.join(STATE_ROOT, 'local-swe-task');

Findings

2 Critical11 High5 Medium3 Low

CriticalRemote Asset Decode Executedist/bundle/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/bundle/index.js

HighChild Processscripts/postinstall.js

HighShellscripts/postinstall.js

HighSame File Env Network Executioncomate-engine/assets/hooks/local-swe-task-reporter.js

HighCredential Redirect Persistencedist/bundle/index.js

HighEntrypoint Foreign Package Code Overwritedist/bundle/index.js

HighCommand Output Exfiltrationdist/bundle/index.js

HighSandbox Evasion Gated Capabilitydist/bundle/index.js

HighObfuscated Payload Loaderdist/bundle/index.js

HighTrigger Reachable Command Output Exfiltration