@superatomai/sdk-node@0.0.45-dsp
Node.js TypeScript SDK for Superatom
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo malicious install hook, payload staging, foreign-package mutation, or confirmed exfiltration chain was found. The documented runtime nevertheless provides reachable arbitrary code execution for agent-authored scripts with inherited secrets.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A connected Superatom runtime receives USER_PROMPT_REQ and the agent writes then executes a script.
Impact
A compromised prompt, agent, or trusted WebSocket workflow could execute arbitrary Node code and access the host environment.
Mechanism
Agent-authored local script execution with inherited environment variables.
AI rationale
No malicious install hook, payload staging, foreign-package mutation, or confirmed exfiltration chain was found. The documented runtime nevertheless provides reachable arbitrary code execution for agent-authored scripts with inherited secrets.
Evidence
package.jsondist/index.jsdist/userResponse/scripts/script-bootstrap.jsREADME.md
Network endpoints1
wss://ws.superatom.ai/websocket
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The runtime saves agent-provided script bodies, then executes them.
- Scripts are imported in a child Node process with the parent environment inherited.
- Incoming WebSocket USER_PROMPT_REQ messages reach the agent workflow that can author scripts.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- No source evidence of remote payload download/decode/execute or dependency overwrite was found.
- The code-execution feature is documented as a Superatom data-agent scripting workflow rather than concealed install-time behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/index.jsView file
54logger: () => logger,
L55: normalizeScriptBody: () => normalizeScriptBody,
L56: openaiLLM: () => openaiLLM,
...
L66:
L67: // src/websocket.ts
L68: var import_ws = __toESM(require("ws"));
...
L949: constructor() {
L950: const envLevel = (process.env.SUPERATOM_LOG_LEVEL || "info").toLowerCase();
L951: if (this.isValidLogLevel(envLevel)) {
...
L1809: const cipher = import_crypto3.default.createCipheriv(this.algorithm, this.encryptionKey, iv);
L1810: let encrypted = cipher.update(payload, "utf8", "base64");
L1811: encrypted += cipher.final("base64");
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.jsView on unpkg · L54•Trigger-reachable chain: manifest.main -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg10532// src/userResponse/scripts/script-runner.ts
L10533: var import_child_process = require("child_process");
L10534: var path5 = __toESM(require("path"));
Findings
2 Critical4 High4 Medium5 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShell
HighEvaldist/index.js
HighEntrypoint Foreign Package Code Overwritedist/index.js
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/index.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @superatomai/sdk-node@0.0.45-dsp.
See all versions of @superatomai/sdk-node for other recorded verdicts.
- Review the evidence and your use of @superatomai/sdk-node@0.0.45-dsp before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.