@leanandmean/coding-agent@0.74.1-scramjet.52
Coding agent CLI with read, bash, edit, write tools and session management
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete credential theft, install-time mutation, persistence, or self-dependent lifecycle chain was found. Runtime downloading of latest executable assets and command-capable bundled code warrant a warning rather than a clean verdict.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Running agent features that call command execution or ensure a missing helper tool.
Impact
A compromised upstream release asset or untrusted command input could execute code with the user's privileges.
Mechanism
Runtime command execution and automatic helper-binary download.
AI rationale
No concrete credential theft, install-time mutation, persistence, or self-dependent lifecycle chain was found. Runtime downloading of latest executable assets and command-capable bundled code warrant a warning rather than a clean verdict.
Evidence
dist/core/exec.jsdist/utils/tools-manager.jsdist/utils/shell.jsexamples/extensions/doom-overlay/doom/build/doom.jsexamples/extensions/notify.tsexamples/extensions/github-issue-autocomplete.ts
Network endpoints2
api.github.comgithub.com
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runtime can spawn commands, including an optional shell mode.
- When fd or rg is absent, runtime code downloads a latest GitHub release, extracts it, and installs its binary.
- The bundled Doom WebAssembly loader includes a Node shell-command bridge.
- Example extensions execute PowerShell notifications and GitHub CLI commands during agent events.
Evidence against
- package.json has no preinstall, install, postinstall, or self-dependency.
- The downloader is limited to fd and ripgrep release assets and has an offline opt-out.
- The flagged Highlight.js file identifies itself as a BSD-3-Clause third-party library.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flaggeddist/core/exec.jsView file
3*/
L4: import { spawn } from "node:child_process";
L5: import { StringDecoder } from "node:string_decoder";
High
dist/utils/tools-manager.jsView file
187const script = "& { param($archive, $destination) $ErrorActionPreference = 'Stop'; Expand-Archive -LiteralPath $archive -DestinationPath $destination -Force }";
L188: const powershellFailure = runExtractionCommand("powershell.exe", [
L189: "-NoLogo",
High
examples/extensions/doom-overlay/doom-engine.tsView file
Findings
8 High6 Medium5 Low
HighChild Processdist/core/exec.js
HighShelldist/utils/tools-manager.js
HighCommand Output Exfiltrationexamples/extensions/doom-overlay/doom/build/doom.js
HighSemantic Analysis Limiteddist/utils/shell.js#virtual:normalized:round1
HighKnown Malware Source Similarityexamples/extensions/doom-overlay/doom/build/doom.js
HighKnown Malware Source Similarityexamples/extensions/notify.ts
HighKnown Malware Source Similaritydist/core/export-html/vendor/highlight.min.js
HighKnown Malware Source Similarityexamples/extensions/github-issue-autocomplete.ts
MediumDynamic Requiredist/core/extensions/loader.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @leanandmean/coding-agent@0.74.1-scramjet.52.
See all versions of @leanandmean/coding-agent for other recorded verdicts.
- Review the evidence and your use of @leanandmean/coding-agent@0.74.1-scramjet.52 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.