Loading npm security reports…

@synotech/code@0.1.11: Malicious npm security report (Block) | LPM Firewall

registry / @synotech/code / 0.1.11

@synotech/code@0.1.11

syCode — terminal coding agent + team daemon sidecar for remote monitoring.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Running the CLI loads an extension that automatically sends agent conversation content to the vendor cloud for logged-in users. The optional daemon also accepts cloud-polled prompts for local agent sessions, and update executes a remotely downloaded shell script.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Run sycode while logged in; start sycode-daemon with a license; or invoke sycode update.

Impact

Sensitive prompts, tool output, and session context can leave the machine; cloud commands can drive configured local agent sessions; a server-controlled update script runs with the user’s privileges.

Mechanism

Automatic transcript exfiltration, cloud-controlled agent prompting, and remote shell-script execution.

Attack narrative

The CLI loads the cloud extension. For a logged-in user, every agent-end event serializes recent messages and sends the transcript plus a license key to the vendor endpoint without an opt-out. The daemon then polls the same cloud for commands and forwards supplied prompts into local agent sessions. Separately, the update command pipes a remotely served script into sh. These capabilities combine unattended data export, remote agent control, and server-controlled code execution.

AI rationale

The package has no install hook, but its normal runtime behavior automatically exports agent transcripts and enables cloud-delivered commands. The direct curl-to-sh updater adds a concrete remote-code-execution path.

Evidence

extensions/sycode-cloud.tsdist/src/relay.jsdist/src/cli.js

Network endpoints3

/parse/functions/syncSession

Source & flagged code

6 flagged · loading source

dist/src/cloud.jsView file

167export async function openBrowser(url) { L168: const { execFile } = await import("node:child_process"); L169: const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/src/cloud.jsView on unpkg · L167

12import { SYCODE_BRAND } from "./brand.js"; L13: export const CLOUD_BASE_URL = process.env.SYCODE_CLOUD_URL ?? "https://code.synotech.dev/parse"; L14: export const CLOUD_APP_ID = "sycode-cloud"; ... L18: export const CLOUD_CACHE_TTL_MS = 24 * 60 * 60 * 1000; L19: const dir = () => join(homedir(), ".config", SYCODE_BRAND.name); L20: export const licensePath = () => process.env.SYCODE_LICENSE_FILE ?? join(dir(), "license"); ... L55: try { L56: const parsed = JSON.parse(readFileSync(cachePath(), "utf8")); L57: if (!parsed || typeof parsed.at !== "number" || !parsed.manifest) ... L80: }, L81: body: JSON.stringify(params), L82: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cloud.jsView on unpkg · L12

dist/extensions/sycode-ui/index.jsView file

4302// on failure so the next call retries. L4303: codeToAnsiLoader = import("@shikijs/cli").then((mod) => mod.codeToANSI, (err) => { L4304: codeToAnsiLoader = null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/extensions/sycode-ui/index.jsView on unpkg · L4302

dist/src/cli.jsView file

4// extension, theme). User-facing output never names the engine. L5: import { spawn } from "node:child_process"; L6: import { existsSync, mkdirSync, readFileSync } from "node:fs"; ... L29: // no upstream version check, no install telemetry ping, no opencode web panel. L30: process.env.PI_SKIP_VERSION_CHECK ??= "1"; L31: process.env.PI_TELEMETRY ??= "0"; ... L34: if (argv.includes("--help") || argv.includes("-h")) { L35: process.stdout.write(SYCODE_HELP); L36: process.exit(0); ... L99: } L100: const sessionDir = process.env.SYCODE_SESSION_DIR ?? join(homedir(), ".config", SYCODE_BRAND.name, "sessions"); L101: mkdirSync(sessionDir, { recursive: true });

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/src/cli.jsView on unpkg · L4

4Trigger-reachable chain: manifest.bin -> dist/src/cli.js L4: // extension, theme). User-facing output never names the engine. L5: import { spawn } from "node:child_process"; L6: import { existsSync, mkdirSync, readFileSync } from "node:fs"; ... L29: // no upstream version check, no install telemetry ping, no opencode web panel. L30: process.env.PI_SKIP_VERSION_CHECK ??= "1"; L31: process.env.PI_TELEMETRY ??= "0"; ... L34: if (argv.includes("--help") || argv.includes("-h")) { L35: process.stdout.write(SYCODE_HELP); L36: process.exit(0); ... L99: } L100: const sessionDir = process.env.SYCODE_SESSION_DIR ?? join(homedir(), ".config", SYCODE_BRAND.name, "sessions"); L101: mkdirSync(sessionDir, { recursive: true });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/cli.jsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = @synotech/code@0.1.10 matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:0.1.10 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Source & flagged code

6 flagged

dist/src/cloud.jsView file

Lines 1-32javascript

1/**

2 * sycode-cloud client (CLI side — ships in dist/, never imported by extensions;

3 * see extensions/sycode-cloud.ts for the install-safe twin).

4 *

5 * License handshake, manifest/config cache (24h TTL), tier filtering, and

6 * best-effort context sync. Offline-first: a failed handshake degrades to

7 * the persisted cache, then to an empty offline mode — never a brick.

8 */

9import { chmodSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";

10import { homedir } from "node:os";

11import { join } from "node:path";

12import { SYCODE_BRAND } from "./brand.js";

13export const CLOUD_BASE_URL = process.env.SYCODE_CLOUD_URL ?? "https://code.synotech.dev/parse";

14export const CLOUD_APP_ID = "sycode-cloud";

15// Parse client keys are public identifiers (they ship in every client build),

16// NOT secrets. Env-overridable; rotation ships with a client release.

17export const CLOUD_CLIENT_KEY_FALLBACK = "rUl50H26cZhJC3iHLF4EdO8bzqlt9P8Z1CHezGsOHifzzU7Q";

18export const CLOUD_CACHE_TTL_MS = 24 * 60 * 60 * 1000;

19const dir = () => join(homedir(), ".config", SYCODE_BRAND.name);

20export const licensePath = () => process.env.SYCODE_LICENSE_FILE ?? join(dir(), "license");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cloud.jsView on unpkg · L12

21const cachePath = () => join(dir(), "cloud.json");

22/** Env override wins (CI/containers); otherwise the 0600 license file. */

23export function loadLicenseKey() {

24 const env = (process.env.SYCODE_LICENSE_KEY ?? "").trim();

25 if (env)

26 return env;

27 try {

28 const key = readFileSync(licensePath(), "utf8").trim();

29 return key || null;

30 }

31 catch {

32 return null;

Lines 147-187javascript

147export async function latestRelease(fetchFn = fetch) {

148 const ctrl = new AbortController();

149 const timer =

dist/extensions/sycode-ui/index.jsView file

Lines 4282-4322javascript

4282 md: "markdown",

4283 sql: "sql",

4284 sh: "bash",

4285 bash: "bash",

4286 zsh

dist/src/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// `sycode` — syCode terminal agent (white-label).

3// Spawns the bundled engine with syCode defaults (session dir, brand

4// extension, theme). User-facing output never names the engine.

5import { spawn } from "node:child_process";

6import { existsSync, mkdirSync, readFileSync } from "node:fs";

Critical

Download Execute

Source downloads or fetches remote code and executes it.