@cotal-ai/connector-jcode@0.135.5
Cotal connector for Jcode: a host-mode mesh peer driven through Jcode's Harness API bridge.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package’s connector purpose explains launching Jcode, but its host startup also automatically mirrors credentials from numerous unrelated local AI and coding tools into the managed agent’s home. I found no proof of credential exfiltration, so this is a warning for cross-service credential exposure rather than a confirmed malicious transfer.
Static reason
One or more suspicious static signals were detected.
Trigger
Startup of the managed Jcode host.
Impact
The agent can act using credentials from services beyond Jcode. No unrelated outbound credential transfer was established in the inspected source.
Mechanism
The host enumerates credential files under the user home and copies them into the seat's private Jcode home before launching the agent.
AI rationale
The package’s connector purpose explains launching Jcode, but its host startup also automatically mirrors credentials from numerous unrelated local AI and coding tools into the managed agent’s home. I found no proof of credential exfiltration, so this is a warning for cross-service credential exposure rather than a confirmed malicious transfer.
Evidence
dist/host.js~/.claude/.credentials.json~/.codex/auth.json~/.gemini/oauth_creds.json~/.cursor/auth.json~/.config/github-copilot/hosts.json~/.config/github-copilot/apps.json~/.openclaw/agent/auth.json~/.local/share/opencode/auth.json
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The connector enumerates credentials from Jcode and external stores, including Claude, Codex, Gemini, Cursor, GitHub Copilot, OpenClaw, and OpenCode.
- It copies the discovered credential files into a per-seat Jcode home.
- The credential mirroring runs during managed host startup, without a separate per-provider consent check in the shown path.
Evidence against
- The package describes itself as a connector that runs a Jcode Harness API peer, which gives the local agent a legitimate reason to use provider credentials.
- I found no evidence that this code sends the copied credentials to Cotal or another unrelated host; the concern is their automatic exposure to the managed agent.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
7 flaggeddist/host.jsView file
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
High
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/host.jsView on unpkg · L111109L110: `)}}doc.write(`payload.value = newResult;`);doc.write(`return payload;`);const fn=doc.compile();return(payload,ctx)=>fn(shape,payload,ctx)};let fastpass;const isObject2=isObject;co...
L111:
L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
Findings
5 High4 Medium5 Low
HighChild Processdist/host.js
HighSame File Env Network Executiondist/host.js
HighCommand Output Exfiltrationdist/host.js
HighCross File Remote Execution Contextdist/host.js
HighShips High Entropy Blobdist/docs-bundle.bin
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/docs-bundle.bin
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/host.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cotal-ai/connector-jcode@0.135.5.
See all versions of @cotal-ai/connector-jcode for other recorded verdicts.
- Review the evidence and your use of @cotal-ai/connector-jcode@0.135.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.