@superatomai/sdk-node@0.0.18-dsp
Node.js TypeScript SDK for Superatom
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package contains real dangerous runtime primitives, but they are package-aligned SDK features reached through explicit runtime calls rather than npm lifecycle or stealth import behavior. No concrete malicious payload, credential exfiltration, destructive action, or foreign AI-agent control hijack was confirmed by source inspection.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime use of SDK methods such as connect(), dashboard-agent collection run, or script runner paths
Impact
A host application that passes untrusted script paths/prompts/tools could cause local code execution or project runtime file writes, but the package itself does not auto-trigger this on install/import.
Mechanism
user-invoked child_process spawn and dynamic import of caller-provided scripts
AI rationale
The package contains real dangerous runtime primitives, but they are package-aligned SDK features reached through explicit runtime calls rather than npm lifecycle or stealth import behavior. No concrete malicious payload, credential exfiltration, destructive action, or foreign AI-agent control hijack was confirmed by source inspection.
Evidence
package.jsondist/index.jsdist/index.mjsdist/userResponse/scripts/script-bootstrap.jsREADME.mdcaller-provided scriptPath.pi-dashboard-agent-runtime/dashboard.log.pi-dashboard-agent-runtime/.pi-dashboard-sessions.json.pi-dashboard-agent-runtime/drafts/*.json.prompts/dashboard-agent
Network endpoints2
wss://ws.superatom.ai/websocketopenrouter.ai/api/v1
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with high false-positive risk.
Evidence for warning
- dist/index.js spawns a Node/tsx subprocess to execute caller-provided scriptPath via dist/userResponse/scripts/script-bootstrap.js
- dist/userResponse/scripts/script-bootstrap.js dynamically imports SCRIPT_ARG and runs exported getData with a bridge ctx
- dist/index.js loads @earendil-works/pi-coding-agent through new Function dynamic import and registers dashboard-agent collections
- dist/index.js writes dashboard-agent runtime/session/log files under .pi-dashboard-agent-runtime and .prompts/dashboard-agent during explicit dashboard-agent use
Evidence against
- package.json has no preinstall/install/postinstall hooks and only exports dist entrypoints
- No unconsented install-time mutation of AI-agent control surfaces found
- Network endpoints are package-aligned SDK/LLM/WebSocket paths, mainly wss://ws.superatom.ai/websocket and OpenRouter/proxy configuration
- No credential harvesting loop or exfiltration of arbitrary environment/files found; API keys are used for configured LLM providers
- Scanner remote-asset decode/execute label was not confirmed in source; observed dynamic execution is local caller-provided scripts
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
54logger: () => logger,
L55: normalizeScriptBody: () => normalizeScriptBody,
L56: openaiLLM: () => openaiLLM,
...
L66:
L67: // src/websocket.ts
L68: var import_ws = __toESM(require("ws"));
...
L923: constructor() {
L924: const envLevel = (process.env.SUPERATOM_LOG_LEVEL || "info").toLowerCase();
L925: if (this.isValidLogLevel(envLevel)) {
...
L1707: const cipher = import_crypto3.default.createCipheriv(this.algorithm, this.encryptionKey, iv);
L1708: let encrypted = cipher.update(payload, "utf8", "base64");
L1709: encrypted += cipher.final("base64");
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L54•Trigger-reachable chain: manifest.main -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg9791// src/userResponse/scripts/script-runner.ts
L9792: var import_child_process = require("child_process");
L9793: var path5 = __toESM(require("path"));
High
22399// src/dashboardAgent/collection.ts
L22400: var dynamicImport = new Function("specifier", "return import(specifier)");
L22401: var piModulePromise = null;
High
67// src/websocket.ts
L68: var import_ws = __toESM(require("ws"));
L69: function createWebSocket(url) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L67README.mdView file
186patternName = generic_password
severity = medium
line = 186
matchedText = password...rd',
Medium
194patternName = generic_password
severity = medium
line = 194
matchedText = password...rd',
Medium
Findings
2 Critical3 High6 Medium4 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShell
HighEvaldist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret PatternREADME.md
MediumSecret PatternREADME.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @superatomai/sdk-node@0.0.18-dsp.
See all versions of @superatomai/sdk-node for other recorded verdicts.
- Review the evidence and your use of @superatomai/sdk-node@0.0.18-dsp before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.