registry / @leanandmean/coding-agent / 0.74.1-scramjet.50
@leanandmean/coding-agent@0.74.1-scramjet.50
Coding agent CLI with read, bash, edit, write tools and session management
AI Security Review
scanned 2mo ago · by lpm-firewall-aiInspected source shows a coding-agent CLI with no npm install lifecycle and no hidden exfil. Residual risk is dual-use shell and GitHub binary download behavior plus minified Emscripten, WASM, and highlight.js that could not be fully AST-verified, so this is a warn rather than a clean or block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm install runs no package lifecycle scripts; these capabilities start when a user runs the CLI, uses find or grep, or loads optional examples.
Impact
No confirmed supply-chain compromise; users who run the agent get intended shell and tool-download power, with leftover uncertainty in unparsed minified files.
Mechanism
User-invoked coding-agent execution plus unverified minified and WASM example assets
AI rationale
Inspected source shows a coding-agent CLI with no npm install lifecycle and no hidden exfil. Residual risk is dual-use shell and GitHub binary download behavior plus minified Emscripten, WASM, and highlight.js that could not be fully AST-verified, so this is a warn rather than a clean or block.
Evidence
examples/extensions/doom-overlay/doom/build/doom.jsdist/core/export-html/vendor/highlight.min.jsdist/utils/tools-manager.jsdist/core/exec.js
Network endpoints2
api.github.comgithub.com
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Dangerous Capability with high false-positive risk.
Evidence for warning
- Minified Emscripten glue in the Doom example cannot be fully AST-parsed and is paired with a WASM binary.
- Vendor highlight.min.js is minified Highlight.js that the scanner could not fully parse.
- When find or grep tools run, the package can download fd and ripgrep GitHub release archives and extract them into the agent bin directory.
- Shared exec and shell helpers spawn processes to run agent and extension commands after the user starts the CLI.
- Optional examples launch PowerShell toast notifications and call the GitHub CLI.
Evidence against
- package.json has only clean, dev, build, copy-assets, and test scripts; there is no preinstall, install, or postinstall hook.
- dist/index.js only re-exports the SDK and does not run a payload on import.
- Network use is GitHub tool downloads, LLM provider auth, and other documented product endpoints.
- Doom overlay, notify, and GitHub autocomplete are opt-in examples, not auto-loaded at install.
- Shell, file, and download behavior matches this package's stated coding-agent CLI purpose.
Behavioral surface
Source & flagged code
12 flaggeddist/core/exec.jsView file
3*/
L4: import { spawn } from "node:child_process";
L5: import { StringDecoder } from "node:string_decoder";
High
dist/utils/tools-manager.jsView file
187const script = "& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }";
L188: const powershellFailure = runExtractionCommand("powershell.exe", [
L189: "-NoLogo",
High
examples/extensions/doom-overlay/doom-engine.tsView file
Findings
8 High6 Medium5 Low
HighChild Processdist/core/exec.js
HighShelldist/utils/tools-manager.js
HighCommand Output Exfiltrationexamples/extensions/doom-overlay/doom/build/doom.js
HighSemantic Analysis Limiteddist/utils/shell.js#virtual:normalized:round1
HighKnown Malware Source Similarityexamples/extensions/doom-overlay/doom/build/doom.js
HighKnown Malware Source Similarityexamples/extensions/notify.ts
HighKnown Malware Source Similaritydist/core/export-html/vendor/highlight.min.js
HighKnown Malware Source Similarityexamples/extensions/github-issue-autocomplete.ts
MediumDynamic Requiredist/core/extensions/loader.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @leanandmean/coding-agent@0.74.1-scramjet.50.
See all versions of @leanandmean/coding-agent for other recorded verdicts.
- Review the evidence and your use of @leanandmean/coding-agent@0.74.1-scramjet.50 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.