@cotal-ai/connector-jcode@0.136.3
Cotal connector for Jcode: a host-mode mesh peer driven through Jcode's Harness API bridge.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe connector automatically makes a wide range of local AI credentials available to its Jcode process, which is a meaningful default capability with user-data exposure risk. I found no source evidence that those credentials are sent to an unrelated collector, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Starting the managed Jcode host.
Impact
Credentials from other AI tools become accessible to the Jcode process without a separate opt-in, creating risk if that process or its integrations misuse them.
Mechanism
The host inventories local credentials and copies them into the private instance home; the SDK helper also supports linking external credential files.
AI rationale
The connector automatically makes a wide range of local AI credentials available to its Jcode process, which is a meaningful default capability with user-data exposure risk. I found no source evidence that those credentials are sent to an unrelated collector, so this warrants a warning rather than a block.
Evidence
dist/host.js.lpm-dependency-evidence-8ca4d56e-c893-4786-b937-d1f75031b8ac/0/npm-linux/dist/launch.js
Network endpoints2
broker.cotal.ai/v1/feedbackcotal.ai/v1/feedback
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package is a Cotal connector that runs Jcode as a host-mode mesh peer.
- When the Jcode host starts, it calls mirrorJcodeCredentials(home) without an opt-in check.
- The credential mirror inventory includes files for other AI-agent products, including Copilot, OpenClaw, Pi, Hermes and OpenCode.
- The mirror copies credential files into the Jcode instance home; the SDK helper also links external credential stores into an instance home.
- The reviewed code does not establish that these credentials are sent to an unrelated collector.
Evidence against
- Credential mirroring serves the stated purpose of making credentials available to the Jcode process.
- The manifest declares no lifecycle scripts.
- The package has explicit test and build scripts; no install-time behavior was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
Source & flagged code
11 flaggeddist/host.jsView file
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
High
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/host.jsView on unpkg · L111109L110: `)}}doc.write(`payload.value = newResult;`);doc.write(`return payload;`);const fn=doc.compile();return(payload,ctx)=>fn(shape,payload,ctx)};let fastpass;const isObject2=isObject;co...
L111:
L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
Findings
9 High4 Medium5 Low
HighChild Processdist/host.js
HighSame File Env Network Executiondist/host.js
HighCommand Output Exfiltrationdist/host.js
HighCross File Remote Execution Contextdist/host.js
HighShips High Entropy Blobdist/docs-bundle.bin
HighKnown Malware Source Similaritydist/host.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/mcp.js
HighKnown Malware Source Fingerprint Signaturedist/host.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/docs-bundle.bin
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @cotal-ai/connector-jcode@0.136.3.
See all versions of @cotal-ai/connector-jcode for other recorded verdicts.
- Review the evidence and your use of @cotal-ai/connector-jcode@0.136.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.