registry / Credential exfiltration / @scarn/cli
@scarn/cli
Scarn runs AI agents over your backlog, on your machines. This CLI links your repo, designs pipelines with an agent, and runs the workers that execute them.
This report shows the evidence for @scarn/cli@0.0.0. 1 of 5 known versions is blocked or flagged. The newest version, 0.8.3, is allowed. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe bundled Dev Containers CLI uses a vulnerable hostname prefix check before attaching GITHUB_TOKEN to a request for a project-supplied tarball URL. A lookalike external host can receive the token when Scarn processes that project.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a Scarn worker on a project whose Dev Container configuration uses a direct tarball URL beginning with a GitHub hostname string, while GITHUB_TOKEN is set.
Impact
The remote host can capture the GitHub token and use its granted access.
Mechanism
The bundled CLI checks the URL with startsWith, attaches GITHUB_TOKEN as a Bearer token, then sends a GET request to the supplied URL. A URL such as https://github.com.attacker.example/... passes the prefix check but targets a different host.
Attack narrative
When a Scarn worker processes a direct Dev Container feature tarball, the bundled CLI accepts any URL whose text begins with https://github.com or https://api.github.com. If GITHUB_TOKEN is set, it adds that token as a Bearer authorization header and requests the supplied URL. A lookalike hostname such as github.com.attacker.example therefore receives the credential.
AI rationale
The bundled Dev Containers CLI uses a vulnerable hostname prefix check before attaching GITHUB_TOKEN to a request for a project-supplied tarball URL. A lookalike external host can receive the token when Scarn processes that project.
Evidence
dist/devcontainer/dist/spec-node/devcontainers-cli.jsbin/scarnProject Dev Container feature configuration (read)Temporary feature tarball (written at a runtime-generated path)
Network endpoints2
github.comapi.github.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The bundled Dev Containers CLI turns a direct feature tarball URL into its request URL.
- Its auth check accepts URLs beginning with the GitHub hostname strings and attaches GITHUB_TOKEN as a Bearer token.
- The tarball request sends the supplied URL together with the resulting headers.
- The CLI wrapper makes the bundled Dev Containers CLI available to the Scarn worker.
Evidence against
- The README describes Scarn as a CLI that runs agents and workers on the user's machine.
- The postinstall fallback downloads the platform binary from the configured npm registry when its optional dependency is missing.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/devcontainer/dist/spec-node/devcontainers-cli.jsView file
6var hL=Object.create;var LI=Object.defineProperty;var fL=Object.getOwnPropertyDescriptor;var dL=Object.getOwnPropertyNames;var pL=Object.getPrototypeOf,DL=Object.prototype.hasOwnPr...
L7: `)};function sw(A){var e=/\.[^.]*$/.exec(A);return e?e.index+1:A.length}function gw(A,e,t){if(A.reduce)return A.reduce(e,t);for(var i=0,r=arguments.length>=3?t:A[i++];i<A.length;i+...
L8:
L9: `),x())}function x(k){if(k||l--,u++,c===u&&l===0&&r!==void 0)return r(B||null)}}});var by=O((kz,Ny)=>{"use strict";Ny.exports=function A(e){var t=arguments.length;if(typeof e=="fun...
L10: `).join(`
...
L12: `)}function x1(A){A?process.env.DEBUG=A:delete process.env.DEBUG}function J1(){return process.env.DEBUG}function K1(A){A.inspectOpts={};let e=Object.keys(it.inspectOpts);for(let t=...
L13: `).map(e=>e.trim()
Findings
1 Critical5 High5 Medium5 Low
CriticalCredential Exfiltrationdist/devcontainer/dist/spec-node/devcontainers-cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/devcontainer/dist/spec-node/devcontainers-cli.js
HighSame File Env Network Executiondist/devcontainer/dist/spec-node/devcontainers-cli.js
HighCommand Output Exfiltrationdist/devcontainer/dist/spec-node/devcontainers-cli.js
HighSemantic Analysis Limitedbin/postinstall.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/postinstall.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @scarn/cli@0.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @scarn/cli@0.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.