registry / @leanandmean/coding-agent / 0.74.1-scramjet.61
@leanandmean/coding-agent@0.74.1-scramjet.61
Coding agent CLI with read, bash, edit, write tools and session management
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package intentionally provides executable extension and shell capabilities activated during agent use. Static inspection found no concrete malicious delivery, persistence, or exfiltration behavior, so this is a non-blocking guarded extension-lifecycle risk.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user starts the coding agent with extensions enabled, or an enabled agent session invokes its bash capability.
Impact
A malicious extension or agent-directed shell command could execute with the user's local permissions; this is a guarded agent-extension capability rather than a confirmed package attack.
Mechanism
Enabled extension paths are dynamically imported, and the bash tool passes commands to a local shell.
AI rationale
The package intentionally provides executable extension and shell capabilities activated during agent use. Static inspection found no concrete malicious delivery, persistence, or exfiltration behavior, so this is a non-blocking guarded extension-lifecycle risk.
Evidence
dist/core/extensions/loader.jsdist/core/resource-loader.jsdist/core/tools/bash.js
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a Scramjet configuration directory and has no npm install lifecycle hook.
- The extension loader dynamically imports an extension path through Jiti.
- The loader discovers extensions in project-local and global extension directories.
- Runtime resource loading passes enabled extension paths to the extension loader unless extensions are disabled.
- The coding-agent bash tool spawns a selected shell with a supplied command.
Evidence against
- No install-time hook, self-dependency, credential export, or package-controlled network recipient was identified in the inspected entrypoint paths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flaggeddist/core/exec.jsView file
3*/
L4: import { spawn } from "node:child_process";
L5: import { StringDecoder } from "node:string_decoder";
High
dist/utils/clipboard.jsView file
42[
L43: "powershell.exe",
L44: [
High
examples/extensions/doom-overlay/doom-engine.tsView file
64
Findings
1 Critical8 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/core/tools/bash.js
HighChild Processdist/core/exec.js
HighShelldist/utils/clipboard.js
HighCommand Output Exfiltrationexamples/extensions/doom-overlay/doom/build/doom.js
HighSemantic Analysis Limiteddist/utils/shell.js#virtual:normalized:round1
HighKnown Malware Source Similarityexamples/extensions/doom-overlay/doom/build/doom.js
HighKnown Malware Source Similarityexamples/extensions/notify.ts
HighKnown Malware Source Similaritydist/core/export-html/vendor/highlight.min.js
HighKnown Malware Source Similarityexamples/extensions/github-issue-autocomplete.ts
MediumNetwork
Medium
Affected versions and remediation
This report applies to @leanandmean/coding-agent@0.74.1-scramjet.61.
See all versions of @leanandmean/coding-agent for other recorded verdicts.
- Review the evidence and your use of @leanandmean/coding-agent@0.74.1-scramjet.61 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.