registry / Data exfiltration / aegiscode

aegiscode

AEGIS CLI — AI-powered coding assistant

This report shows the evidence for aegiscode@5.2.33. 4 of 70 known versions are blocked or flagged. The newest version, 7.0.11, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is concrete, default-enabled exfiltration of full assistant sessions after ordinary login, contradicted by the package's privacy claim. The install hook itself is non-malicious.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Run the CLI after normal AEGIS Cloud login, then exit a session.

Impact

Full coding-assistant session contents are sent remotely without an explicit sync opt-in.

Mechanism

default-enabled authenticated conversation exfiltration

Attack narrative

The CLI login path writes an AEGIS Cloud API key but does not disable sync. On session exit, the bundled UI serializes all session messages and POSTs them with that key to aegiscloud.org; the guard treats any value other than false as enabled. The README says fully local/Ollama use leaves nothing off-machine and describes sync as requiring activation, making the automatic upload materially misleading.

AI rationale

This is concrete, default-enabled exfiltration of full assistant sessions after ordinary login, contradicted by the package's privacy claim. The install hook itself is non-malicious.

Evidence

bin/cli.jspackage.jsonREADME.mdscripts/ensure-node-version.mjs~/.aegiscode/config.json

Network endpoints1

aegiscloud.org/api/conversations/cli-sync

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

bin/cli.js uploads full session messages to aegiscloud.org on exit.
Normal Google login stores an API key; sync defaults on unless explicitly false.
README claims fully local use leaves nothing, contradicting the default upload path.

Evidence against

package.json preinstall only checks the Node version and exits.
Cloud upload uses the package's branded aegiscloud.org endpoint.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 272 KB of source, external domains: aegiscode.dev, deb.nodesource.com, dl.aegiscloud.org, github.com

Oversized source lightweight scan

bin/cli.js7.73 MB file, sampled 256 KB

Filesystem

Source & flagged code

16 flagged

package.jsonView file

•scripts.preinstall = node scripts/ensure-node-version.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/cli.jsView file

173. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function D(){eI.asyncTransitions--}function j(z){if(FG===null)try{var dI=("requir... L19: `+NI.replace(/^Error(:[^\n]*)?\n/,""))});return nI.prototype=Object.create(U.prototype),nI.prototype.constructor=nI,nI.prototype.toString=function(){return this.message===void 0?th... ... L25: `)e&&(c+=ndI("")),c+=v4I(t);else if(h===` L26: `){let r=[...t];H4I(Z.slice(N+1),r),c+=g4I(r),e&&(c+=ndI(e))}N+=h.length}return c}});import BY from"node:process";import{execFileSync as C4I}from"node:child_process";import kv from... L27: at`)?" (<anonymous>)":-1<i.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/cli.jsView on unpkg · L17

3L4: var QCI=Object.create;var OB=Object.defineProperty;var XCI=Object.getOwnPropertyDescriptor;var HCI=Object.getOwnPropertyNames;var vCI=Object.getPrototypeOf,gCI=Object.prototype.has... L5: `);let c;for(;(c=LCI.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function zCI(l){l=l||{};let I=xnI(l);l.path=I;let G=bn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function D(){eI.asyncTransitions--}function j(z){if(FG===null)try{var dI=("requ

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/cli.jsView on unpkg · L3

3Trigger-reachable chain: manifest.bin -> bin/cli.js L3: L4: var QCI=Object.create;var OB=Object.defineProperty;var XCI=Object.getOwnPropertyDescriptor;var HCI=Object.getOwnPropertyNames;var vCI=Object.getPrototypeOf,gCI=Object.prototype.has... L5: `);let c;for(;(c=LCI.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function zCI(l){l=l||{};let I=xnI(l);l.path=I;let G=bn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function D(){eI.asyncTransi

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/cli.jsView on unpkg · L3

25`)e&&(c+=ndI("")),c+=v4I(t);else if(h===` L26: `){let r=[...t];H4I(Z.slice(N+1),r),c+=g4I(r),e&&(c+=ndI(e))}N+=h.length}return c}});import BY from"node:process";import{execFileSync as C4I}from"node:child_process";import kv from... L27: at`)?" (<anonymous>)":-1<i.stack.indexOf("@")?"@unknown:0:0":""}return`

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L25

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cli.jsView on unpkg · L17

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L3

3Trigger-reachable credential exfiltration chain: manifest.bin -> bin/cli.js L3: L4: var QCI=Object.create;var OB=Object.defineProperty;var XCI=Object.getOwnPropertyDescriptor;var HCI=Object.getOwnPropertyNames;var vCI=Object.getPrototypeOf,gCI=Object.prototype.has... L5: `);let c;for(;(c=LCI.exec(G))!=null;){let e=c[1],t=c[2]||"";t=t.trim();let n=t[0];t=t.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),n==='"'&&(t=t.replace(/\\n/g,` L6: `),t=t.replace(/\\r/g,"\r")),I[e]=t}return I}function zCI(l){l=l||{};let I=xnI(l);l.path=I;let G=bn.configDotenv(l);if(!G.parsed){let n=new Error(`MISSING_DATA: Cannot parse ${I} f... L7: ... L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}fun

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

bin/cli.jsView on unpkg · L3

17Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/cli.js L17: 3. You might have more than one copy of React in the same app L18: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function D(){eI.asyncTransitions--}function j(z){if(FG===null)try{var dI=("requir... L19: `+NI.replace(/^Error(:[^\n]*)?\n/,""))});return nI.prototype=Object.create(U.prototype),nI.prototype.constructor=nI,nI.prototype.toString=function(){return this.message===void 0?th... ... L25: `)e&&(c+=ndI("")),c+=v4I(t);else if(h===` L26: `){let r=[...t];H4I(Z.slice(N+1),r),c+=g4I(r),e&&(c+=ndI(e))}N+=h.length}return c}});import BY from"node:process";import{execFileSync as C4I}from"node:child_process";import kv from... L27: at`)?" (<anonymous>)":-1<i.sta

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

bin/cli.jsView on unpkg · L17

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = aegiscode@5.2.24 matchedPath = bin/cli.js matchedIdentity = npm:YWVnaXNjb2Rl:5.2.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

•path = bin/cli.js kind = oversized_source_file sizeBytes = 8103947 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

bin/cli.jsView on unpkg

•path = bin/cli.js kind = oversized_cli_entrypoint sizeBytes = 8103947 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/cli.jsView on unpkg

scripts/release-local.shView file

•path = scripts/release-local.sh kind = build_helper sizeBytes = 3031 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-local.shView on unpkg

scripts/install-alacritty.shView file

•matchType = normalized_sha256 matchedPackage = aegiscode@5.2.24 matchedPath = scripts/install-alacritty.sh matchedIdentity = npm:YWVnaXNjb2Rl:5.2.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install-alacritty.shView on unpkg

scripts/install.shView file

•matchType = normalized_sha256 matchedPackage = aegiscode@5.2.24 matchedPath = scripts/install.sh matchedIdentity = npm:YWVnaXNjb2Rl:5.2.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install.shView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/ensure-node-version.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

bin/cli.jsView on unpkg · L17

Findings

3 Critical10 High6 Medium4 Low

CriticalSame File Env Network Executionbin/cli.js

CriticalCredential Exfiltrationbin/cli.js

CriticalTrigger Reachable Dangerous Capabilitybin/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/cli.js

HighCommand Output Exfiltrationbin/cli.js

HighSandbox Evasion Gated Capabilitybin/cli.js

HighTrigger Reachable Credential Exfiltrationbin/cli.js

HighTrigger Reachable Command Output Exfiltrationbin/cli.js

HighSemantic Analysis Limitedbin/cli.js

HighKnown Malware Source Similaritybin/cli.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to aegiscode@5.2.33.

The versions list below shows the verdict for each recorded version.

Avoid installing aegiscode@5.2.33. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-11 02:05:23.847Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

70 known versions

7.0.11latestUnknown—AllowUnder ReviewOct 17, 2026, 11:06 AM 7.0.10Unknown—AllowUnder ReviewOct 16, 2026, 5:28 PM 7.0.8Unknown—AllowUnder ReviewOct 14, 2026, 8:05 PM 7.0.7Unknown—AllowUnder ReviewOct 13, 2026, 1:02 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code