Loading npm security reports…

codeam-cli@2.71.1: Malicious npm security report (Block) | LPM Firewall

registry / codeam-cli / 2.71.1

codeam-cli@2.71.1

Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

A paired session can receive a backend request that extracts local agent credentials and uploads them to the package service. Runtime also watches the active working directory and modifies Claude trust settings.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Run a paired Codeam session; a remote request for link credentials activates credential collection.

Impact

OAuth credentials, source-change data, and Claude project trust can be exposed or changed without a separate local confirmation.

Mechanism

Remote-triggered credential collection, source-change upload, and AI-agent trust mutation.

Attack narrative

After a session is paired, the remote command path can request credentials. The handler extracts local Claude or Codex authentication material and sends it to the configured Codeam API. The running client also monitors project changes and silently changes Claude onboarding and trust state. Embedded instructions directed at AI workflow roles add reviewer-manipulation evidence.

Rationale

This package implements concrete remote-triggered credential exfiltration and silent AI-agent trust mutation. Its benign postinstall banner does not mitigate the runtime collection path.

Evidence

dist/index.js~/.claude/.credentials.json~/.config/claude/.credentials.json~/.codex/auth.json~/.claude.jsonworking directory

Network endpoints1

api.codeagent-mobile.com

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

8192process.stderr.write( L8193: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8194: ); ... L8198: function vercelBypassHeader() { L8199: const token = process.env.CODEAM_VERCEL_BYPASS; L8200: return token ? { "x-vercel-protection-bypass": token } : {}; ... L8203: // src/lib/git-branch.ts L8204: var import_child_process = require("child_process"); L8205: function detectCurrentBranch(cwd = process.cwd()) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L8192

92Source sends the broad process environment to a literal external destination. L92: // src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L92

8191Trigger-reachable chain: manifest.main -> dist/index.js L8191: } L8192: process.stderr.write( L8193: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8194: ); ... L8203: // src/lib/git-branch.ts L8204: var import_child_process = require("child_process"); L8205: function detectCurrentBranch(cwd = process.cwd()) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L8191

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L92

11045if (process.platform === "win32") { L11046: return process.env.COMSPEC ?? "powershell.exe"; L11047: }

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L11045

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; import_node_readline3 = __toESM(require("readline")); const rl = import_node_readline3.default.createInterface({ input: stdin, crlfDelay: Infinity }); const rl = import_node_readline3.default.createInterface({ input: child.stdout, crlfDelay: Infinity }); async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) { const res = await fetchImpl(`${baseUrl}/api/${api}`, { headers: { Authorization: `Convex ${key}`, "Content-Type": "application/json" }

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

8191} L8192: process.stderr.write( L8193: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8194: ); ... L8203: // src/lib/git-branch.ts L8204: var import_child_process = require("child_process"); L8205: function detectCurrentBranch(cwd = process.cwd()) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L8191

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L92

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L312: } L313: async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) { L314: const res = await fetchImpl(`${baseUrl}/api/${api}`, { ... L3102: const tmp = `${debugFilePath}.${process.pid}.tmp`; L3103: fs.writeFileSync(tmp, header); L3104: fs.renameSync(tmp, debugFilePath);

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L92

10157package = codeam-cli; repositoryIdentity = codeagent-mobile-clients; dependency = chokidar L10157: try { L10158: return require("chokidar"); L10159: } catch {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L10157

8191Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L8191: } L8192: process.stderr.write( L8193: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8194: ); ... L8203: // src/lib/git-branch.ts L8204: var import_child_process = require("child_process"); L8205: function detectCurrentBranch(cwd = process.cwd()) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L8191

14285fs12.writeFileSync(this.helperPath, PYTHON_PTY_HELPER, { mode: 420 }); L14286: this.proc = (0, import_child_process8.spawn)(python, [this.helperPath, cmd, ...args2], { L14287: stdio: ["pipe", "pipe", "inherit"], ... L14300: \u2717 Failed to launch Claude Code: ${err.message} L14301: Make sure claude is correctly installed: npm install -g @anthropic-ai/claude-code L14302: `

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L14285

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = tonty-tech-interviews@0.2.66 matchedPath = vendor/node-pty-darwin-arm64/lib/unixTerminal.js matchedIdentity = npm:dG9udHktdGVjaC1pbnRlcnZpZXdz:0.2.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/unixTerminal.jsView on unpkg

dist/vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.61.71 matchedPath = dist/vendor/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.61.71 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg

Source & flagged code

18 flagged

package.jsonView file

Lines 4-44json

4 "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",

5 "type": "commonjs",

6 "main": "dist/index.js",

7 "bin": {

8 "codeam": "dist/index.js"

9 },

10 "files": [

11 "dist/index.js",

12 "dist/postinstall.js",

13 "dist/vendor",

14 "README.md",

15 "CHANGELOG.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsup && node scripts/vendor-node-pty.js",

20 "dev": "tsup --watch",

21 "test": "vitest run",

22 "test:coverage": "vitest run --coverage",

23 "typecheck": "tsc --noEmit",

24 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "e2e": "playwright test"

27 },

28 "keywords": [

29 "claude",

30 "claude-code",

31 "ai",

32 "ai-agent",

33 "ai-coding",

34 "ai-workflow",

35 "ai-workflow-continuity",

36 "async-ai-productivity",

37 "remote-ai-supervision",

38 "cli",

39 "developer-tools",

40 "devtools",

41 "codeagent",

42 "codeam",

43 "anthropic",

44 "openai-codex",

dist/index.jsView file

8192process.stderr.write( L8193: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8194: ); ... L8198: function vercelBypassHeader() { L8199: const token = process.env.CODEAM_VERCEL_BYPASS; L8200: return token ? { "x-vercel-protection-bypass": token } : {}; ... L8203: // src/lib/git-branch.ts L8204: var import_child_process = require("child_process"); L8205: function detectCurrentBranch(cwd = process.cwd()) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L8192

92Source sends the broad process environment to a literal external destination. L92: // src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L92

8191

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = tonty-tech-interviews@0.2.66 matchedPath = vendor/node-pty-darwin-arm64/lib/unixTerminal.js matchedIdentity = npm:dG9udHktdGVjaC1pbnRlcnZpZXdz:0.2.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/unixTerminal.jsView on unpkg

dist/vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.61.71 matchedPath = dist/vendor/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.61.71 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg