registry / @cotal-ai/connector-jcode / 0.133.2
@cotal-ai/connector-jcode@0.133.2
Cotal connector for Jcode: a host-mode mesh peer driven through Jcode's Harness API bridge.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe automatic reuse of multiple unrelated AI-tool credentials creates a real account and quota risk when connector workflows run. I found no direct credential exfiltration, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Starting the managed Jcode connector host.
Impact
Jcode workflows initiated through the connector may be able to act using credentials and account quotas from other AI tools.
Mechanism
The host inventories credential files under the user's home directory and copies them into the private Jcode home for the local runtime to use.
AI rationale
The automatic reuse of multiple unrelated AI-tool credentials creates a real account and quota risk when connector workflows run. I found no direct credential exfiltration, so this warrants a warning rather than a block.
Evidence
dist/host.jsdist/index.js~/.claude/.credentials.json~/.codex/auth.json~/.gemini/oauth_creds.json
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package has no install lifecycle hooks; its manifest exposes dist/index.js and lists only typecheck, test, build, and bundle scripts.
- The Jcode host mirrors credentials when it starts, before handling resume setup.
- The credential inventory includes external stores such as .claude/.credentials.json, .codex/auth.json, and .gemini/oauth_creds.json.
- The mirror copies inventoried credential files into the Jcode home; no opt-in is visible in this startup path.
Evidence against
- The package is a Jcode Harness connector, and the host launches a local Jcode process for that purpose.
- The reviewed connector code shows local credential copying, but no direct transmission of those copied credential contents to Cotal or another host.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
7 flaggeddist/host.jsView file
50${cb}`:comment}}if(afterDoc){for(let i=0;i<this.errors.length;++i)doc.errors.push(this.errors[i]);for(let i=0;i<this.warnings.length;++i)doc.warnings.push(this.warnings[i])}else{do...
L51: ${end.comment}`:end.comment}this.doc.range[2]=end.offset;break}default:this.errors.push(new errors.YAMLParseError(getErrorPos(token2),"UNEXPECTED_TOKEN",`Unsupported token ${token2...
L52: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
High
49${cb}`:comment}else{const cb=dc.commentBefore;dc.commentBefore=cb?`${comment}
L50: ${cb}`:comment}}if(afterDoc){for(let i=0;i<this.errors.length;++i)doc.errors.push(this.errors[i]);for(let i=0;i<this.warnings.length;++i)doc.warnings.push(this.warnings[i])}else{do...
L51: ${end.comment}`:end.comment}this.doc.range[2]=end.offset;break}default:this.errors.push(new errors.YAMLParseError(getErrorPos(token2),"UNEXPECTED_TOKEN",`Unsupported token ${token2...
L52: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/host.jsView on unpkg · L49Findings
5 High4 Medium5 Low
HighChild Processdist/host.js
HighSame File Env Network Executiondist/host.js
HighCommand Output Exfiltrationdist/host.js
HighCross File Remote Execution Contextdist/host.js
HighShips High Entropy Blobdist/docs-bundle.bin
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/docs-bundle.bin
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/host.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cotal-ai/connector-jcode@0.133.2.
See all versions of @cotal-ai/connector-jcode for other recorded verdicts.
- Review the evidence and your use of @cotal-ai/connector-jcode@0.133.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.