Loading npm security reports…

@synotech/code@1.5.7: Malicious npm security report (Block) | LPM Firewall

registry / @synotech/code / 1.5.7

@synotech/code@1.5.7

syCode — terminal coding agent + team daemon sidecar for remote monitoring.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

A user-run update fetches and executes an unauthenticated remote shell script. During normal logged-in agent use, the extension automatically uploads compacted conversation transcripts to the vendor service.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Run `sycode update`, or complete an agent turn while logged in.

Impact

A changed remote installer can execute arbitrary commands; uploaded transcripts may disclose conversation and project information to the vendor service.

Mechanism

Remote shell execution and automatic cloud transcript synchronization.

Attack narrative

The CLI's explicit update path invokes a shell command that downloads and executes a remote script without an integrity check. Separately, the extension registered by the CLI uploads compacted agent messages after each completed turn while the user is logged in, with no opt-out in the shown implementation. Together these behaviors permit remote code delivery and automatic transmission of potentially sensitive agent conversations.

AI rationale

The package contains concrete remote-code-execution and automatic transcript-upload behavior. Although neither occurs at npm install time, the lack of installer verification and automatic data synchronization warrant blocking publication.

Evidence

dist/src/cli.jsdist/extensions/sycode-cloud.js~/.config/sycode/device.json~/.config/sycode/license

Network endpoints2

code.synotech.dev/install.sh

Source & flagged code

12 flagged · loading source

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView file

1import { spawn as nodeSpawn } from 'node:child_process'; L2: import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView on unpkg · L1

dist/extensions/sycode-mcp-adapter/utils.jsView file

108const result = spawnSync(value.slice(1), { L109: shell: true, L110: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/extensions/sycode-mcp-adapter/utils.jsView on unpkg · L108

dist/extensions/sycode-background/src/core/anthropic-attribution.jsView file

1660try { L1661: const dynamicImport = new Function('specifier', 'return import(specifier)'); L1662: const mod = await dynamicImport('@earendil-works/pi-ai/anthropic');

High

Eval

Package source references dynamic code evaluation.

dist/extensions/sycode-background/src/core/anthropic-attribution.jsView on unpkg · L1660

dist/extensions/sycode-ui/index.jsView file

4302// on failure so the next call retries. L4303: codeToAnsiLoader = import("@shikijs/cli").then((mod) => mod.codeToANSI, (err) => { L4304: codeToAnsiLoader = null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/extensions/sycode-ui/index.jsView on unpkg · L4302

extensions/sycode-mcp-adapter/mcp-script-worker.mjsView file

40if (value.type === "image" && typeof value.data === "string" && typeof value.mimeType === "string") { L41: return { type: "image", data: value.data, mimeType: value.mimeType }; L42: }

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

extensions/sycode-mcp-adapter/mcp-script-worker.mjsView on unpkg · L40

dist/extensions/sycode-mcp-adapter/ui-session.jsView file

83function isRemoteSession() { L84: return Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY); L85: } ... L87: return new Promise((resolve) => { L88: execFile("who", { encoding: "utf8", timeout: 2000 }, (error, out) => { L89: if (error) { ... L98: return new Promise((resolve) => { L99: const socket = net.connect({ host: "127.0.0.1", port: 24543 }); L100: const done = (ok) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/extensions/sycode-mcp-adapter/ui-session.jsView on unpkg · L83

dist/src/cli.jsView file

4// extension, theme). User-facing output never names the engine. L5: import { spawn } from "node:child_process"; L6: import { existsSync, mkdirSync, readFileSync } from "node:fs"; ... L30: // no upstream version check, no install telemetry ping, no opencode web panel. L31: process.env.PI_SKIP_VERSION_CHECK ??= "1"; L32: process.env.PI_TELEMETRY ??= "0"; ... L36: // Share links open our viewer, never the upstream one. L37: process.env.PI_SHARE_VIEWER_URL ??= "https://code.synotech.dev/share/"; L38: const argv = process.argv.slice(2); L39: if (argv.includes("--help") || argv.includes("-h")) { L40: process.stdout.write(SYCODE_HELP); L41: process.exit(0);

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/src/cli.jsView on unpkg · L4

4Trigger-reachable chain: manifest.bin -> dist/src/cli.js L4: // extension, theme). User-facing output never names the engine. L5: import { spawn } from "node:child_process"; L6: import { existsSync, mkdirSync, readFileSync } from "node:fs"; ... L30: // no upstream version check, no install telemetry ping, no opencode web panel. L31: process.env.PI_SKIP_VERSION_CHECK ??= "1"; L32: process.env.PI_TELEMETRY ??= "0"; ... L36: // Share links open our viewer, never the upstream one. L37: process.env.PI_SHARE_VIEWER_URL ??= "https://code.synotech.dev/share/"; L38: const argv = process.argv.slice(2); L39: if (argv.includes("--help") || argv.includes("-h")) { L40: process.stdout.write(SYCODE_HELP); L41: process.exit(0);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/cli.jsView on unpkg · L4

dist/src/cloud.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @synotech/code@1.3.0 matchedIdentity = npm:QHN5bm90ZWNoL2NvZGU:1.3.0 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cloud.jsView on unpkg

12import { SYCODE_BRAND } from "./brand.js"; L13: export const CLOUD_BASE_URL = process.env.SYCODE_CLOUD_URL ?? "https://code.synotech.dev/api"; L14: export const CLOUD_APP_ID = "sycode-cloud"; ... L18: export const CLOUD_CACHE_TTL_MS = 24 * 60 * 60 * 1000; L19: const dir = () => join(homedir(), ".config", SYCODE_BRAND.name); L20: export const licensePath = () => process.env.SYCODE_LICENSE_FILE ?? join(dir(), "license"); ... L28: try { L29: const parsed = JSON.parse(readFileSync(devicePath(), "utf8")); L30: return typeof parsed.device_token === "string" && parsed.device_token ? parsed.device_token : null; ... L177: }, L178: body: JSON.stringify(params), L179: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/cloud.jsView on unpkg · L12

dist/extensions/sycode-background/src/core/fusion/web-fetch.jsView file

1import { createHash } from 'node:crypto'; L2: import { lookup as nodeLookup } from 'node:dns/promises'; L3: import * as http from 'node:http'; ... L6: import { performance } from 'node:perf_hooks'; L7: import { TextDecoder } from 'node:util'; L8: export const FUSION_WEB_FETCH_TIMEOUT_MS = 90_000; ... L371: response.once('end', () => { L372: settleResolve({ kind: 'success', status, contentType, body: Buffer.concat(chunks, bytesRead) }); L373: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/extensions/sycode-background/src/core/fusion/web-fetch.jsView on unpkg · L1

dist/extensions/sycode-background/src/core/common.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/extensions/sycode-background/src/core/common.js#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView file

Lines 1-21javascript

1import { spawn as nodeSpawn } from 'node:child_process';

2import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/extensions/sycode-background/src/core/fusion/pi-child.jsView on unpkg · L1

3import { constants, existsSync } from 'node:fs';

4import { open } from 'node:fs/promises';

5import { dirname, resolve } from 'node:path';

6import { fileURLToPath } from 'node:url';

7import { FUSION_CANDIDATE_OUTPUT_RECOVERY_PATH_ENV, FUSION_CHILD_MAX_PROVIDER_REQUESTS, FUSION_CHILD_MAX_TOOL_CALLS, FUSION_CHILD_RESULT_PREFIX, FUSION_CHILD_RESULT_SCHEMA_VERSION, FUSION_CHILD_SETTLEMENT_PREFIX, FUSION_CHILD_SETTLEMENT_SCHEMA_VERSION, FUSION_RESEARCH_ENABLED_ENV, FUSION_RUNTIME_GUARD_PREFIX, FUSION_RUNTIME_GUARD_SCHEMA_VERSION, FUSION_SOURCE_POLICY_PATH_ENV, FUSION_SOURCE_POLICY_SHA256_ENV, FUSION_TOOL_CALL_LOG_PATH_ENV, FUSION_TOOL_CALL_SEAL_SCHEMA_VERSION, FUSION_TOOL_CALL_SEAL_SUFFIX, FUSION_CHILD_MAX_TOTAL_TOOL_RESULT_BYTES, buildFusionChildSettlement, isRecoverableFusion ...

8import { FUSION_CLAUDE_CACHE_BREAKPOINT_LIMIT, FUSION_CLAUDE_CACHE_OBSERVATION_SCHEMA_VERSION, FUSION_CLAUDE_CACHE_RETENTION_ENV, } from './claude-cache.js';

9import { FUSION_FORBIDDEN_TOOLS, FUSION_NO_TOOLS_CAPABILITY, FUSION_INSPECT_TOOLS, FUSION_RESEARCH_TOOLS, FUSION_TOOL_CALL_LOG_SCHEMA_VERSION, FUSION_WEB_FETCH_TOOL_NAME, FusionError, addFusionUsage, cloneFusionUsage, createEmptyFusionUsage, } from './types.js';

10import { isJsonObject, parseJsonText } from '../common.js';

11import { FUSION_CANDIDATE_MAX_OUTPUT_BYTES, fusionJsonRenderedTextBytes, } from './output-contract.js';

12import { canonicalizeFusionPublicUrl, readFusionSourcePolicyFile } from './source-policy.js';

13import { assertWindowsCommandLineWithinLimit, piLaunchArgv, resolvePiLaunch, } from '../pi-launch.js';

14import { resolveAnthropicAttributionExtensionPath } from '../anthropic-attribution-path.js';

15// The response cap now applies to one final full answer, not cumulative Pi JSON events.

16export const FUSION_CHILD_STDOUT_LIMIT_BYTES = 32 * 1024 * 1024;

17export const FUSION_CHILD_STDERR_LIMIT_BYTES = 16 * 1024 * 1024;

18export const FUSION_CHILD_TIMEOUT_MS = 50 * 60 * 1000;

19/**

20 * Stale-action watchdog threshold.

21 *

Long lines were clipped for display.

dist/extensions/sycode-mcp-adapter/utils.jsView file

Lines 88-128javascript

88 return interpolateEnvVars(value.slice(1), environment);

89 return value.startsWith("!") ? value : interpolateEnvVars(value, environment);

90}

91

dist/extensions/sycode-background/src/core/anthropic-attribution.jsView file

Lines 1640-1680javascript

1640function createOutput(model) {

1641 return {

1642 role: 'assistant',

1643 content: [],

1644 api: model.api,

1645 provider: model.provider,

1646 model: model.id,

dist/extensions/sycode-ui/index.jsView file

Lines 4282-4322javascript

4282 md: "markdown",

4283 sql: "sql",

4284 sh: "bash",

4285 bash: "bash",

4286 zsh

extensions/sycode-mcp-adapter/mcp-script-worker.mjsView file

Lines 20-60javascript

20}

21

22function formatValue(value) {

23 if (typeof value === "string") return value;

24 try {

dist/extensions/sycode-mcp-adapter/ui-session.jsView file

Lines 63-103javascript

63 structuredContent,

64 };

65}

66async function openInBrowser(state, url, signal) {

67 throwIfAborted(signal);

68 try

dist/src/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// `sycode` — syCode terminal agent (white-label).

3// Spawns the bundled engine with syCode defaults (session dir, brand

4// extension, theme). User-facing output never names the engine.

5import { spawn } from "node:child_process";

6import { existsSync, mkdirSync, readFileSync } from "node:fs";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/src/cloud.jsView file

Lines 1-32javascript

1/**

2 * sycode-cloud client (CLI side — ships in dist/, never imported by extensions;

3 * see extensions/sycode-cloud.ts for the install-safe twin).

4 *

5 * License handshake, manifest/config cache (24h TTL), tier filtering, and

6 * best-effort context sync. Offline-first: a failed handshake degrades to

7 * the persisted cache, then to an empty offline mode — never a brick.

8 */

9import { chmodSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"

dist/extensions/sycode-background/src/core/fusion/web-fetch.jsView file

1import { createHash } from 'node:crypto'; L2: import { lookup as nodeLookup } from 'node:dns/promises'; L3: import * as http from 'node:http'; ... L6: import { performance } from 'node:perf_hooks'; L7: import { TextDecoder } from 'node:util'; L8: export const FUSION_WEB_FETCH_TIMEOUT_MS = 90_000; ... L371: response.once('end', () => { L372: settleResolve({ kind: 'success', status, contentType, body: Buffer.concat(chunks, bytesRead) }); L373: });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/extensions/sycode-background/src/core/fusion/web-fetch.jsView on unpkg · L1

dist/extensions/sycode-background/src/core/common.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/extensions/sycode-background/src/core/common.js#virtual:normalized:round1View on unpkg