coda-cli@1.0.18
NodeJS命令行端 AI 辅助编程助手
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe update path installs a globally named package that differs from the manifest and uses sudo on non-Windows systems; source inspection does not establish whether this is intentional. The configured API-key transfer is part of a chat request to its configured or protocol-default AI endpoint, and the inspected account-action paths do not show a separate automatic account action.
Static reason
One or more suspicious static signals were detected.
Trigger
A CLI command's child process exits successfully and the update check finds a newer version.
Impact
The update flow could install code from a package other than coda-cli.
Mechanism
The CLI invokes a global npm install of code-cli, adding sudo on non-Windows systems.
AI rationale
The update path installs a globally named package that differs from the manifest and uses sudo on non-Windows systems; source inspection does not establish whether this is intentional. The configured API-key transfer is part of a chat request to its configured or protocol-default AI endpoint, and the inspected account-action paths do not show a separate automatic account action.
Evidence
bin/index.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest identifies coda-cli@1.0.18 and exposes bin/index.js as the coda command, with no install lifecycle hook.
- After a successful child command exits, the CLI checks for an update; when one is found, it runs a global install of code-cli, using sudo on non-Windows systems.
- The chat client sends its configured API key as a bearer token to the endpoint selected from its configured base URL or protocol defaults.
- The inspected CLI account-action locations are part of command argument handling and successful child-command completion; they do not establish a separate automatic account action.
Evidence against
- The package manifest lists only build and typecheck scripts, and the package's network request is an AI chat request to the configured or protocol-default endpoint.
- The source does not establish whether installing code-cli is an intended rename or a package-name error.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedbin/index.jsView file
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={450(e,t,s){t.childProcess=void 0;const a=s(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(s=>{(0,a.spawn)(e,{cwd:t,stdio:"inherit",shell...
L3: //# sourceMappingURL=index.js.map
High
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={450(e,t,s){t.childProcess=void 0;const a=s(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(s=>{(0,a.spawn)(e,{cwd:t,stdio:"inherit",shell...
L3: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/index.jsView on unpkg · L12,s),i=(0,n.fork)(a,[e],{silent:!1});i.on("error",e=>{console.clear(),r.CLI.log.error(e.message,e.stack),C()}),i.on("exit",e=>{0===e&&C()})}(l,p,c)):(r.CLI.loading.succeed(i.Lang.CLI_HAS_READY),r.CLI.log.error(i.Lang.MSG_ERROR,`${i.Lang.NO_COMMAND} "${t} ${e.join(" ")}"`),process.exit())}async function C(){let e=o.fs.join(p,"package.json");r.CLI.loading.start(i.Lang.CORE_CHECKING_UPDATE);let t=o.fs.readFile(
Medium
Findings
3 High5 Medium4 Low
HighChild Processbin/index.js
HighSame File Env Network Executionbin/index.js
HighCommand Output Exfiltrationgenerator/chat/index.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencebin/index.js
MediumAi Review Evidencebin/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to coda-cli@1.0.18.
See all versions of coda-cli for other recorded verdicts.
- Review the evidence and your use of coda-cli@1.0.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.