@cotal-ai/connector-jcode@0.135.19
Cotal connector for Jcode: a host-mode mesh peer driven through Jcode's Harness API bridge.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe host automatically copies credentials from multiple unrelated AI tools into a Jcode home each time it starts, without a credential-specific opt-in. This is credential collection beyond the connector's stated purpose, even though the inspected excerpts do not show direct transmission.
Static reason
One or more suspicious static signals were detected.
Trigger
Starting the Jcode connector host.
Impact
Other tools' credentials are exposed to the launched Jcode process without a separate opt-in; no direct external transmission was established in the inspected code.
Mechanism
The host scans known credential paths and mirrors found files into its private Jcode home before launching Jcode's API bridge.
Attack narrative
When the connector host starts, it scans for credentials belonging to Claude, Codex, Gemini, Cursor, Copilot, OpenClaw, and other tools, then copies discovered files into its private Jcode home before launching the Jcode API bridge. The connector's stated purpose is to bridge Jcode; automatically collecting this broad set of other tools' credentials is unrelated to that purpose. The reviewed code shows local staging, but not direct network transmission of those credentials.
AI rationale
The host automatically copies credentials from multiple unrelated AI tools into a Jcode home each time it starts, without a credential-specific opt-in. This is credential collection beyond the connector's stated purpose, even though the inspected excerpts do not show direct transmission.
Evidence
dist/host.js~/.claude/.credentials.json~/.codex/auth.json~/.gemini/oauth_creds.json~/.cursor/auth.json~/.config/github-copilot/hosts.json~/.openclaw/agent/auth.jsonJcode home/external/
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- The host enumerates credential files for Claude, Codex, Gemini, Cursor, GitHub Copilot, OpenClaw, and other tools.
- Its mirror routine copies discovered credential files into a private Jcode home.
- The host calls that routine during startup without a credential-specific opt-in.
- The host launches Jcode's API bridge after preparing the credential mirror.
Evidence against
- The package describes itself as a Jcode Harness API connector, which explains launching Jcode.
- No install lifecycle scripts are declared.
- The inspected code shows local credential copying, but no direct outbound transmission of those copied credentials.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/host.jsView file
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
High
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/host.jsView on unpkg · L111109L110: `)}}doc.write(`payload.value = newResult;`);doc.write(`return payload;`);const fn=doc.compile();return(payload,ctx)=>fn(shape,payload,ctx)};let fastpass;const isObject2=isObject;co...
L111:
L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
Findings
5 High4 Medium5 Low
HighChild Processdist/host.js
HighSame File Env Network Executiondist/host.js
HighCommand Output Exfiltrationdist/host.js
HighCross File Remote Execution Contextdist/host.js
HighShips High Entropy Blobdist/docs-bundle.bin
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/docs-bundle.bin
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/host.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cotal-ai/connector-jcode@0.135.19.
See all versions of @cotal-ai/connector-jcode for other recorded verdicts.
- Avoid installing @cotal-ai/connector-jcode@0.135.19. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.