@cotal-ai/connector-jcode@0.140.6
Cotal connector for Jcode: a host-mode mesh peer driven through Jcode's Harness API bridge.
AI Security Review
scanned 22h ago · by lpm-firewall-aiThe host automatically copies authentication material from several unrelated AI tools into the Jcode process’s private home. This is credential collection beyond what the connector’s stated Jcode purpose requires, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Starting the connector host; no separate credential-sharing opt-in is shown in the reviewed startup path.
Impact
Jcode can access credentials for services beyond the Jcode account and potentially use them to act as the user. The reviewed excerpts do not establish a specific outbound destination.
Mechanism
The host inventories credential files under the user’s home, including Claude, Codex, Gemini, Cursor, and GitHub Copilot files, then copies them into the Jcode credential mirror. It also extracts selected Cursor authentication state.
Attack narrative
When the connector host starts, it automatically inventories credentials from multiple AI tools in the user’s home and stages them in the Jcode private home. This gives the Jcode process access to credentials for services unrelated to the Jcode account without a separate sharing choice. The reviewed excerpts show the credential collection and transfer into Jcode’s home, but do not identify a specific outbound recipient.
AI rationale
The host automatically copies authentication material from several unrelated AI tools into the Jcode process’s private home. This is credential collection beyond what the connector’s stated Jcode purpose requires, so the package should be blocked.
Evidence
dist/host.js~/.claude/.credentials.json~/.codex/auth.json~/.gemini/oauth_creds.json~/.cursor/auth.json~/.config/cursor/auth.json~/.config/github-copilot/hosts.json~/.config/github-copilot/apps.json~/.config/Cursor/User/globalStorage/state.vscdbJcode private home: external/<source-relative-path>
Decision evidence
public snapshotAI called this Malicious at 87.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package’s host implementation lists credential files from Claude, Codex, Gemini, Cursor, GitHub Copilot, and other AI tools as external credential sources.
- The host builds a credential inventory from the user’s home directory and maps those files into the Jcode credential mirror.
- Host startup calls mirrorJcodeCredentials(home) before starting the Jcode session.
- The mirror copies each inventoried non-Cursor-state credential file into the private Jcode home and publishes selected Cursor authentication state there.
Evidence against
- The package is described as a Jcode connector, and the credential mirror writes into a private Jcode home.
- The reviewed excerpts do not identify an outbound host that receives the copied credentials.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
11 flaggeddist/host.jsView file
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
High
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/host.jsView on unpkg · L111109L110: `)}}doc.write(`payload.value = newResult;`);doc.write(`return payload;`);const fn=doc.compile();return(payload,ctx)=>fn(shape,payload,ctx)};let fastpass;const isObject2=isObject;co...
L111:
L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
Findings
9 High4 Medium5 Low
HighChild Processdist/host.js
HighSame File Env Network Executiondist/host.js
HighCommand Output Exfiltrationdist/host.js
HighCross File Remote Execution Contextdist/host.js
HighShips High Entropy Blobdist/docs-bundle.bin
HighKnown Malware Source Similaritydist/host.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/mcp.js
HighKnown Malware Source Fingerprint Signaturedist/host.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/docs-bundle.bin
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @cotal-ai/connector-jcode@0.140.6.
See all versions of @cotal-ai/connector-jcode for other recorded verdicts.
- Avoid installing @cotal-ai/connector-jcode@0.140.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.