@leanandmean/coding-agent@0.74.1-scramjet.81
Coding agent CLI with read, bash, edit, write tools and session management
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe inspected login path performs publisher-selected account changes by enabling every known GitHub Copilot model after authentication, without a separate affirmative choice for that scope. This is concrete account-control behavior and warrants blocking publication.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user completes GitHub Copilot OAuth login in the CLI.
Impact
The package changes the user's Copilot account settings beyond completing authentication.
Mechanism
The login flow obtains a Copilot access token, iterates over all catalog models, and sends an authenticated POST setting each model policy to enabled.
Attack narrative
After the user selects GitHub Copilot and completes OAuth login, the provider automatically submits authenticated policy updates for every known Copilot model, setting each to enabled. The flow does not ask the user to approve this account-wide change separately.
AI rationale
The inspected login path performs publisher-selected account changes by enabling every known GitHub Copilot model after authentication, without a separate affirmative choice for that scope. This is concrete account-control behavior and warrants blocking publication.
Evidence
package.jsondist/modes/interactive/interactive-mode.jsdist/core/auth-storage.js.lpm-dependency-evidence-80a66e04-ac53-42a7-a39e-05551550025d/1/npm-linux/dist/utils/oauth/github-copilot.js.lpm-dependency-evidence-80a66e04-ac53-42a7-a39e-05551550025d/1/npm-linux/dist/models.generated.js
Network endpoints1
`${baseUrl}/models/${modelId}/policy`
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes an interactive CLI whose OAuth login calls the selected provider through auth storage.
- After GitHub Copilot login, the provider automatically enables every model returned by its Copilot catalog.
- For each model, the code sends an authenticated POST to its policy endpoint with state set to enabled.
- The policy endpoint host is derived from the authenticated Copilot token; no separate confirmation for enabling all models is shown in this flow.
Evidence against
- The account changes occur during a user-selected GitHub Copilot login and are described as making models available; the inspected flow does not show credential exfiltration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
12 flaggeddist/core/exec.jsView file
3*/
L4: import { spawn } from "node:child_process";
L5: import { StringDecoder } from "node:string_decoder";
High
dist/utils/clipboard.jsView file
42[
L43: "powershell.exe",
L44: [
High
examples/extensions/doom-overlay/doom-engine.tsView file
64
Findings
9 High5 Medium5 Low
HighChild Processdist/core/exec.js
HighShelldist/utils/clipboard.js
HighCommand Output Exfiltrationexamples/extensions/doom-overlay/doom/build/doom.js
HighSemantic Analysis Limiteddist/utils/shell.js#virtual:normalized:round1
HighKnown Malware Source Similarityexamples/extensions/doom-overlay/doom/build/doom.js
HighKnown Malware Source Similarityexamples/extensions/notify.ts
HighKnown Malware Source Similaritydist/core/export-html/vendor/highlight.min.js
HighKnown Malware Source Similaritydist/core/export-html/vendor/marked.min.js
HighKnown Malware Source Similarityexamples/extensions/github-issue-autocomplete.ts
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @leanandmean/coding-agent@0.74.1-scramjet.81.
See all versions of @leanandmean/coding-agent for other recorded verdicts.
- Avoid installing @leanandmean/coding-agent@0.74.1-scramjet.81. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.