coda-cli@1.9.34
一款支持完全离线部署的研发效能一体化命令行助手
AI Security Review
scanned 11h ago · by lpm-firewall-aiThe newly added media server exposes a network-reachable terminal gateway that spawns a shell for each connection and accepts input without authentication. This is remote command execution unrelated to the service’s stated media purpose, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user manually starts the media server; a remote client connects to its terminal WebSocket endpoint.
Impact
A reachable client can execute commands as the server process user and access that host account’s files and environment.
Mechanism
Each connection spawns Bash or PowerShell, streams terminal output, and forwards client-supplied terminal input to the PTY. The server binds to 0.0.0.0 by default.
Attack narrative
When the media server is started, it listens on all interfaces by default. Any reachable client can connect to its terminal WebSocket, receive a Bash or PowerShell session, and send input directly to the PTY. This grants remote command execution under the server process account. The CLI describes the added service as a media server and instructs users to start it manually; the exposed shell is unrelated to that stated purpose.
AI rationale
The newly added media server exposes a network-reachable terminal gateway that spawns a shell for each connection and accepts input without authentication. This is remote command execution unrelated to the service’s stated media purpose, so the package should be blocked.
Evidence
packages/coda-media-server/main.jspackages/coda-media-server/package.jsongenerator/add-media-server/index.js
Network endpoints1
ws://<host>:10088/terminal-ws
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- A terminal WebSocket connection starts a Bash or PowerShell PTY with the host process environment.
- The WebSocket handler accepts terminal input and writes it directly to the PTY.
- The media server listens on 0.0.0.0 by default and exposes the terminal gateway at /terminal-ws with wildcard CORS.
- The added service is described as a media server; its CLI setup tells users to start it manually.
Evidence against
- The CLI’s media-server setup is an explicit command, and the setup instructions require the user to start the server.
- The server’s package description identifies video processing and file upload/download as its purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggedbin/index.jsView file
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={996(e,t,a){t.childProcess=void 0;const s=a(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(a=>{const n=(0,s.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
High
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={996(e,t,a){t.childProcess=void 0;const s=a(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(a=>{const n=(0,s.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/index.jsView on unpkg · L1generator/chat/index.jsView file
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={996(e,t,a){t.childProcess=void 0;const s=a(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(a=>{const n=(0,s.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
Findings
1 Critical4 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltapackages/coda-media-server/main.js
HighChild Processbin/index.js
HighSame File Env Network Executionbin/index.js
HighCommand Output Exfiltrationgenerator/chat/index.js
HighShips High Entropy Blobpackages/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobpackages/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionpackages/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
Affected versions and remediation
This report applies to coda-cli@1.9.34.
See all versions of coda-cli for other recorded verdicts.
- Avoid installing coda-cli@1.9.34. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.