registry / @cotal-ai/connector-jcode / 0.136.7
@cotal-ai/connector-jcode@0.136.7
Cotal connector for Jcode: a host-mode mesh peer driven through Jcode's Harness API bridge.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe flagged process execution belongs to the connector’s local Jcode API bridge, and credential mirroring supports that runtime’s provider access. The reviewed source does not show credentials being sent to an unrelated collector or another concrete attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
The host framework launches a managed Jcode session.
Impact
Credential mirroring supports Jcode provider access; the reviewed source does not establish credential theft or another attack.
Mechanism
The host mirrors recognized credentials into a private Jcode home, then the SDK starts the local Jcode API bridge. No unrelated credential destination or harmful behavior was established.
AI rationale
The flagged process execution belongs to the connector’s local Jcode API bridge, and credential mirroring supports that runtime’s provider access. The reviewed source does not show credentials being sent to an unrelated collector or another concrete attack.
Evidence
~/.claude/.credentials.json~/.codex/auth.json~/.gemini/oauth_creds.jsonprivate Jcode home
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has no install, preinstall, or postinstall lifecycle script.
- The import entry registers and exports the Jcode connector; it does not start the host.
- When the managed host starts, it mirrors credentials into a private Jcode home before preparing the session.
- The Jcode SDK launches a local `api-bridge` process with an isolated `JCODE_HOME`.
- Credential mirroring is scoped to recognized Jcode and AI-tool credential files for Jcode use.
Evidence against
- The host copies credentials from several AI-tool stores by default; the reviewed code does not show those copies being sent to an unrelated collector.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
11 flaggeddist/host.jsView file
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
High
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/host.jsView on unpkg · L111109L110: `)}}doc.write(`payload.value = newResult;`);doc.write(`return payload;`);const fn=doc.compile();return(payload,ctx)=>fn(shape,payload,ctx)};let fastpass;const isObject2=isObject;co...
L111:
L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
Findings
9 High4 Medium5 Low
HighChild Processdist/host.js
HighSame File Env Network Executiondist/host.js
HighCommand Output Exfiltrationdist/host.js
HighCross File Remote Execution Contextdist/host.js
HighShips High Entropy Blobdist/docs-bundle.bin
HighKnown Malware Source Similaritydist/host.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/mcp.js
HighKnown Malware Source Fingerprint Signaturedist/host.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/docs-bundle.bin
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @cotal-ai/connector-jcode@0.136.7.
See all versions of @cotal-ai/connector-jcode for other recorded verdicts.
- Review the evidence and your use of @cotal-ai/connector-jcode@0.136.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.