coda-cli@1.0.9
NodeJS命令行端 AI 辅助编程助手
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe runtime updater checks coda-cli but installs code-agent, with elevated privileges on non-Windows systems and no confirmation step. The source does not establish a malicious payload or whether this is an intended migration, so this is an unresolved package substitution risk warranting a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
A CLI subcommand exits successfully and the release check finds a newer coda-cli version.
Impact
The update path can install and run lifecycle code from a different package with global privileges.
Mechanism
The launcher runs a global npm install for code-agent, invoking sudo on non-Windows systems, without a confirmation prompt.
AI rationale
The runtime updater checks coda-cli but installs code-agent, with elevated privileges on non-Windows systems and no confirmation step. The source does not establish a malicious payload or whether this is an intended migration, so this is an unresolved package substitution risk warranting a warning.
Evidence
bin/index.js
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes the coda CLI and has no npm install lifecycle hook.
- The launcher checks the coda-cli release and enters its update branch when a newer version is found.
- That branch installs code-agent globally, using sudo on non-Windows systems, without asking for confirmation.
- The update check runs after a CLI subcommand exits successfully.
Evidence against
- The package’s declared scripts are build and typecheck; neither is an install hook.
- The chat feature sends prompts and settings to its configured agent service, whose bundled default is loopback.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggedbin/index.jsView file
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={450(e,t,s){t.childProcess=void 0;const a=s(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(s=>{(0,a.spawn)(e,{cwd:t,stdio:"inherit",shell...
L3: //# sourceMappingURL=index.js.map
High
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={450(e,t,s){t.childProcess=void 0;const a=s(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(s=>{(0,a.spawn)(e,{cwd:t,stdio:"inherit",shell...
L3: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/index.jsView on unpkg · L12ommand] \nCommands:\n\t${s.join("\n\t")}`;r.CLI.loading.succeed(i.Lang.BUILDIN.CLI_HAS_READY),r.CLI.log.info(a),process.exit(0)}async function C(){let e=o.fs.join(p,"package.json");r.CLI.loading.start(i.Lang.BUILDIN.CORE_CHECKING_UPDATE);let t=o.fs.readFile(e,!0),s=u.store,a=o.fs.join(s,u.packageName),n=await o.packages.checkVersion(a,t.version);if("{}"===JSON.stringify(n))r.CLI.loading.info(i.Lang.BUILDIN.CORE_LATEST_VERSION);else{r.CLI.loading.info(i.Lang.BUILDIN.CORE_UPDATE_READY),r.CLI.log.printObject(n);const e="npm install -g code-agent --loglevel info --timing";"win32"===process.platfor
Findings
3 High5 Medium4 Low
HighChild Processbin/index.js
HighSame File Env Network Executionbin/index.js
HighCommand Output Exfiltrationgenerator/chat/index.js
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencebin/index.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to coda-cli@1.0.9.
See all versions of coda-cli for other recorded verdicts.
- Review the evidence and your use of coda-cli@1.0.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.