@synotech/code@1.5.20: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@synotech/code@1.5.20: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

23 flagged · loading source

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView file

1import { spawn as nodeSpawn } from 'node:child_process'; L2: import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-background/src/core/fusion/pi-child.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView on unpkg

dist/extensions/sycode-mcp-adapter/utils.jsView file

108const result = spawnSync(value.slice(1), { L109: shell: true, L110: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/extensions/sycode-mcp-adapter/utils.jsView on unpkg · L108

dist/extensions/sycode-background/src/core/anthropic-attribution.jsView file

1660try { L1661: const dynamicImport = new Function('specifier', 'return import(specifier)'); L1662: const mod = await dynamicImport('@earendil-works/pi-ai/anthropic');

High

Eval

Package source references dynamic code evaluation.

dist/extensions/sycode-background/src/core/anthropic-attribution.jsView on unpkg · L1660

dist/extensions/sycode-mcp-adapter/proxy-modes.jsView file

19import { getInputRequiredNeedsUiDetails } from "./errors.js"; L20: const require = createRequire(import.meta.url); L21: const MAX_REGEX_SEARCH_QUERY_LENGTH = 256;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/extensions/sycode-mcp-adapter/proxy-modes.jsView on unpkg · L19

extensions/sycode-mcp-adapter/mcp-script-worker.mjsView file

40if (value.type === "image" && typeof value.data === "string" && typeof value.mimeType === "string") { L41: return { type: "image", data: value.data, mimeType: value.mimeType }; L42: }

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

extensions/sycode-mcp-adapter/mcp-script-worker.mjsView on unpkg · L40

dist/extensions/sycode-mcp-adapter/ui-session.jsView file

83function isRemoteSession() { L84: return Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY); L85: } ... L87: return new Promise((resolve) => { L88: execFile("who", { encoding: "utf8", timeout: 2000 }, (error, out) => { L89: if (error) { ... L98: return new Promise((resolve) => { L99: const socket = net.connect({ host: "127.0.0.1", port: 24543 }); L100: const done = (ok) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/extensions/sycode-mcp-adapter/ui-session.jsView on unpkg · L83

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-mcp-adapter/ui-session.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-mcp-adapter/ui-session.jsView on unpkg

dist/src/cli.jsView file

4// extension, theme). User-facing output never names the engine. L5: import { spawn } from "node:child_process"; L6: import { existsSync, mkdirSync, readFileSync } from "node:fs"; ... L33: // no upstream version check, no install telemetry ping, no opencode web panel. L34: process.env.PI_SKIP_VERSION_CHECK ??= "1"; L35: process.env.PI_TELEMETRY ??= "0"; ... L39: // Share links open our viewer, never the upstream one. L40: process.env.PI_SHARE_VIEWER_URL ??= "https://code.synotech.dev/share/"; L41: const argv = process.argv.slice(2); L42: if (argv.includes("--help") || argv.includes("-h")) { L43: process.stdout.write(SYCODE_HELP); L44: process.exit(0);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/src/cli.jsView on unpkg · L4

4Trigger-reachable chain: manifest.bin -> dist/src/cli.js L4: // extension, theme). User-facing output never names the engine. L5: import { spawn } from "node:child_process"; L6: import { existsSync, mkdirSync, readFileSync } from "node:fs"; ... L33: // no upstream version check, no install telemetry ping, no opencode web panel. L34: process.env.PI_SKIP_VERSION_CHECK ??= "1"; L35: process.env.PI_TELEMETRY ??= "0"; ... L39: // Share links open our viewer, never the upstream one. L40: process.env.PI_SHARE_VIEWER_URL ??= "https://code.synotech.dev/share/"; L41: const argv = process.argv.slice(2); L42: if (argv.includes("--help") || argv.includes("-h")) { L43: process.stdout.write(SYCODE_HELP); L44: process.exit(0);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/cli.jsView on unpkg · L4

dist/src/cloud.jsView file

12import { SYCODE_BRAND } from "./brand.js"; L13: export const CLOUD_BASE_URL = process.env.SYCODE_CLOUD_URL ?? "https://code.synotech.dev/api"; L14: export const CLOUD_APP_ID = "sycode-cloud"; ... L18: export const CLOUD_CACHE_TTL_MS = 24 * 60 * 60 * 1000; L19: const dir = () => join(homedir(), ".config", SYCODE_BRAND.name); L20: export const licensePath = () => process.env.SYCODE_LICENSE_FILE ?? join(dir(), "license"); ... L28: try { L29: const parsed = JSON.parse(readFileSync(devicePath(), "utf8")); L30: return typeof parsed.device_token === "string" && parsed.device_token ? parsed.device_token : null; ... L177: }, L178: body: JSON.stringify(params), L179: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cloud.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/src/cloud.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cloud.jsView on unpkg

dist/extensions/sycode-background/src/core/fusion/web-fetch.jsView file

1import { createHash } from 'node:crypto'; L2: import { lookup as nodeLookup } from 'node:dns/promises'; L3: import * as http from 'node:http'; ... L6: import { performance } from 'node:perf_hooks'; L7: import { TextDecoder } from 'node:util'; L8: export const FUSION_WEB_FETCH_TIMEOUT_MS = 90_000; ... L371: response.once('end', () => { L372: settleResolve({ kind: 'success', status, contentType, body: Buffer.concat(chunks, bytesRead) }); L373: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/extensions/sycode-background/src/core/fusion/web-fetch.jsView on unpkg · L1

dist/extensions/sycode-background/src/core/common.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/extensions/sycode-background/src/core/common.js#virtual:normalized:round1View on unpkg

dist/extensions/sycode-background/src/core/registry.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-background/src/core/registry.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-background/src/core/registry.jsView on unpkg

dist/extensions/sycode-mcp-adapter/mcp-auth.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-mcp-adapter/mcp-auth.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-mcp-adapter/mcp-auth.jsView on unpkg

extensions/sycode-background/src/core/registry.tsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = extensions/sycode-background/src/core/registry.ts matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-background/src/core/registry.tsView on unpkg

extensions/sycode-mcp-adapter/mcp-auth.tsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = extensions/sycode-mcp-adapter/mcp-auth.ts matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-mcp-adapter/mcp-auth.tsView on unpkg

dist/extensions/sycode-mcp-adapter/request-headers-command.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-mcp-adapter/request-headers-command.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-mcp-adapter/request-headers-command.jsView on unpkg

dist/src/daemon-manage.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/src/daemon-manage.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/daemon-manage.jsView on unpkg

extensions/sycode-background/src/core/fusion/pi-child.tsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = extensions/sycode-background/src/core/fusion/pi-child.ts matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-background/src/core/fusion/pi-child.tsView on unpkg

extensions/sycode-mcp-adapter/request-headers-command.tsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = extensions/sycode-mcp-adapter/request-headers-command.ts matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/sycode-mcp-adapter/request-headers-command.tsView on unpkg

dist/extensions/sycode-background/src/core/attested-pi-run.jsView file

•matchType = normalized_sha256 matchedPackage = @synotech/code@1.5.3 matchedPath = dist/extensions/sycode-background/src/core/attested-pi-run.js matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/extensions/sycode-background/src/core/attested-pi-run.jsView on unpkg