@leanandmean/coding-agent@0.74.1-scramjet.39
Coding agent CLI with read, bash, edit, write tools and session management
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource shows a user-invoked coding agent with shell, file, and GitHub helper-download capabilities and no install lifecycle hook. Scanner malware-similarity hits are example and vendor files, but incomplete parse coverage of generated WASM and minified JS keeps this at a warning rather than a clean bill.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The user runs the CLI or SDK after install, or loads a shipped example extension.
Impact
Commands and file edits run in the user workspace; native fd and ripgrep helpers may be installed under the agent bin directory.
Mechanism
Agent tool execution plus optional GitHub binary download
AI rationale
Source shows a user-invoked coding agent with shell, file, and GitHub helper-download capabilities and no install lifecycle hook. Scanner malware-similarity hits are example and vendor files, but incomplete parse coverage of generated WASM and minified JS keeps this at a warning rather than a clean bill.
Evidence
dist/core/exec.jsdist/utils/tools-manager.jsdist/utils/shell.jsexamples/extensions/doom-overlay/doom/build/doom.jsexamples/extensions/doom-overlay/doom/build/doom.wasm
Network endpoints2
api.github.comgithub.com
Decision evidence
public snapshotAI called this Suspicious at 68.0% confidence as Dangerous Capability with high false-positive risk.
Evidence for warning
- This published package is a coding-agent CLI whose stated job is bash, read, edit, and write tools once the user runs it.
- A shared exec helper spawns arbitrary processes for extensions and custom tools.
- On tool setup it fetches fd and ripgrep from GitHub releases into the agent bin directory.
- Shell setup resolves bash and runs commands with -c.
- Shipped examples run PowerShell toasts, GitHub CLI issue listing, and an Emscripten Doom module through new Function.
- Generated doom.js, shipped WASM, and minified highlight.js were not fully parseable, so a hidden payload in those artifacts is not ruled out.
Evidence against
- package.json scripts are only clean, dev, build, copy-assets, and test; there is no preinstall, install, or postinstall hook.
- The public entry re-exports SDK symbols and does not mutate foreign agent config on import.
- Example extensions load only when the user passes --extension or copies them into the Scramjet extensions directory.
- Network use seen in source is GitHub helper downloads and documented model-provider APIs, not a stealth collector.
- High similarity hits are vendor highlight.js and example/demo files, not an install-time dropper.
Source & flagged code
13 flaggeddist/core/exec.jsView file
3*/
L4: import { spawn } from "node:child_process";
L5: import { StringDecoder } from "node:string_decoder";
High
dist/utils/tools-manager.jsView file
187const script = "& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }";
L188: const powershellFailure = runExtractionCommand("powershell.exe", [
L189: "-NoLogo",
High
examples/extensions/doom-overlay/doom-engine.tsView file
Findings
1 Critical8 High6 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/main.js
HighChild Processdist/core/exec.js
HighShelldist/utils/tools-manager.js
HighCommand Output Exfiltrationexamples/extensions/doom-overlay/doom/build/doom.js
HighSemantic Analysis Limiteddist/utils/shell.js#virtual:normalized:round1
HighKnown Malware Source Similarityexamples/extensions/doom-overlay/doom/build/doom.js
HighKnown Malware Source Similarityexamples/extensions/notify.ts
HighKnown Malware Source Similaritydist/core/export-html/vendor/highlight.min.js
HighKnown Malware Source Similarityexamples/extensions/github-issue-autocomplete.ts
MediumDynamic Requiredist/core/extensions/loader.js
Affected versions and remediation
This report applies to @leanandmean/coding-agent@0.74.1-scramjet.39.
See all versions of @leanandmean/coding-agent for other recorded verdicts.
- Review the evidence and your use of @leanandmean/coding-agent@0.74.1-scramjet.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.