coda-cli@1.5.50
NodeJS命
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe automatic update path installs a differently named global package without a separate confirmation, creating unresolved supply chain risk. The inspected credential transfer follows the configured AI endpoint, and no concrete malicious behavior was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Invoking the CLI with no arguments or with --v when its update check finds a newer version.
Impact
An unrelated global package may be installed without a separate confirmation in the inspected path; source does not establish malicious behavior by that package.
Mechanism
The CLI runs an npm global install command, with sudo on non-Windows systems.
AI rationale
The automatic update path installs a differently named global package without a separate confirmation, creating unresolved supply chain risk. The inspected credential transfer follows the configured AI endpoint, and no concrete malicious behavior was established.
Evidence
bin/index.jsservers/agent-server/main.js
Network endpoints2
api.openai.com/v1127.0.0.1:11434
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes bin/index.js as the coda command and declares no lifecycle scripts.
- On empty CLI input or --v, bin/index.js checks for an update; when a newer version is found, it automatically runs a global install of code-cli, using sudo on non-Windows systems.
- The agent server sends configured API keys to the configured or protocol-default AI endpoint as part of its chat request.
Evidence against
- The CLI install is reached through normal CLI invocation and an update check; the inspected source does not establish that code-cli is malicious or that installation runs during package installation.
- Agent-server credentials are sent to the configured or protocol-default chat endpoint, not shown going to an unrelated recipient.
- The account action matches are in the CLI command-handling path; no automatic publisher-selected account action was established.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
Source & flagged code
6 flaggedbin/index.jsView file
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={450(e,t,s){t.childProcess=void 0;const a=s(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(s=>{const n=(0,a.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
High
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={450(e,t,s){t.childProcess=void 0;const a=s(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(s=>{const n=(0,a.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/index.jsView on unpkg · L1generator/chat/index.jsView file
1(()=>{"use strict";var e={450(e,t,a){t.childProcess=void 0;const s=a(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(a=>{const n=(0,s.spawn)(e,{cwd:t,stdio:"inheri...
L2: //# sourceMappingURL=index.js.map
Findings
4 High4 Medium5 Low
HighChild Processbin/index.js
HighSame File Env Network Executionbin/index.js
HighCommand Output Exfiltrationgenerator/chat/index.js
HighShips High Entropy Blobapps/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobapps/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionapps/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
Affected versions and remediation
This report applies to coda-cli@1.5.50.
See all versions of coda-cli for other recorded verdicts.
- Review the evidence and your use of coda-cli@1.5.50 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.