@cotal-ai/connector-jcode@0.141.11
Cotal connector for Jcode: a host-mode mesh peer driven through Jcode's Harness API bridge.
AI Security Review
scanned 4h ago · by lpm-firewall-aiThe host automatically mirrors credentials for unrelated AI services into the Jcode runtime and starts its API bridge with access to them. This exposes other services' logins without a distinct user consent step, so I classify the package as malicious credential exfiltration.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
When the configured Jcode connector host starts.
Impact
Other AI-service credentials are exposed to the Jcode bridge without a separate consent step, allowing use of those accounts through the bridge.
Mechanism
It inventories and copies external provider credentials into the seat's Jcode home, then launches the API bridge using that home. The inspected source does not establish the bridge's remote endpoint.
Attack narrative
On host startup, the connector collects credentials from other AI tools and copies them into the Jcode seat home. It then launches the Jcode API bridge with that home, making those logins available to the bridge without a separate consent step. The exact remote endpoint was not established from the inspected source.
AI rationale
The host automatically mirrors credentials for unrelated AI services into the Jcode runtime and starts its API bridge with access to them. This exposes other services' logins without a distinct user consent step, so I classify the package as malicious credential exfiltration.
Evidence
dist/host.js.lpm-dependency-evidence-59d44dc9-39a0-4a4c-8e88-d24f9214789e/0/npm-linux/dist/launch.js~/.claude/.credentials.json~/.codex/auth.json~/.gemini/oauth_creds.json~/.cursor/auth.json~/.config/github-copilot/hosts.json~/.config/github-copilot/apps.json
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- The host bundles paths for third-party credentials including Claude, Codex, Gemini, Cursor and GitHub Copilot.
- At host startup, it reads the credential inventory and copies credential files into the Jcode seat home; Cursor auth state is also read and republished there.
- Credential mirroring is invoked unconditionally before the host continues startup.
- The Jcode launcher starts an API bridge with that credential-bearing home as JCODE_HOME; its login inheritance defaults to enabled.
Evidence against
- The package has no npm lifecycle scripts, so this behavior is not triggered during installation.
- The package is a Jcode connector, and starting a Jcode API bridge is part of its stated purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
11 flaggeddist/host.jsView file
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
High
111L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/host.jsView on unpkg · L111109L110: `)}}doc.write(`payload.value = newResult;`);doc.write(`return payload;`);const fn=doc.compile();return(payload,ctx)=>fn(shape,payload,ctx)};let fastpass;const isObject2=isObject;co...
L111:
L112: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}}}for(const entry of ctx.seen.entries()){const seen=entry[1];if(schema===entry[0]){extractToDef(e...
L113: `}}function tryAcquireOnce({path:path4,nonce:nonce3,content}){if(publishAtomic(path4,content)){let released=false;return{kind:"acquired",held:{nonce:nonce3,release(){if(released)re...
L114: ${context}
Findings
9 High4 Medium5 Low
HighChild Processdist/host.js
HighSame File Env Network Executiondist/host.js
HighCommand Output Exfiltrationdist/host.js
HighCross File Remote Execution Contextdist/host.js
HighShips High Entropy Blobdist/docs-bundle.bin
HighKnown Malware Source Similaritydist/host.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/mcp.js
HighKnown Malware Source Fingerprint Signaturedist/host.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/docs-bundle.bin
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @cotal-ai/connector-jcode@0.141.11.
See all versions of @cotal-ai/connector-jcode for other recorded verdicts.
- Avoid installing @cotal-ai/connector-jcode@0.141.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.