Loading npm security reports…

codeam-cli@2.71.2: Malicious npm security report (Block) | LPM Firewall

registry / codeam-cli / 2.71.2

codeam-cli@2.71.2

Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A paired session silently uploads local AI-agent credentials and can upload project environment-file contents. The service also supplies shell scripts that are executed locally during agent switching.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Run codeam pair or operate a paired remote-control session.

Impact

Account credentials and project secrets can be sent to the service, and a service-controlled script can execute with the user's permissions.

Mechanism

Automatic credential and .env collection plus service-provided shell execution.

Attack narrative

Pairing invokes automatic credential linking whenever the server supplies a pairing token. That path extracts a local agent credential and posts it to the package service without a separate user confirmation. During a paired session, commands can synchronize the full project .env file to that service. The same service can return an installScript which later runs with sh -c. Together, these behaviors give the service secret collection and command execution capability on a paired machine.

Rationale

The package contains concrete automatic credential and .env exfiltration paths and executes service-supplied shell code. The harmless postinstall banner does not mitigate these runtime behaviors.

Evidence

dist/index.js.env.env.codeam-restore.tmp

Network endpoints1

api.codeagent-mobile.com

Decision evidence

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

8203process.stderr.write( L8204: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8205: ); ... L8209: function vercelBypassHeader() { L8210: const token = process.env.CODEAM_VERCEL_BYPASS; L8211: return token ? { "x-vercel-protection-bypass": token } : {}; ... L8214: // src/lib/git-branch.ts L8215: var import_child_process = require("child_process"); L8216: function detectCurrentBranch(cwd = process.cwd()) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L8203

92Source sends the broad process environment to a literal external destination. L92: // src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L92

8202Trigger-reachable chain: manifest.main -> dist/index.js L8202: } L8203: process.stderr.write( L8204: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8205: ); ... L8214: // src/lib/git-branch.ts L8215: var import_child_process = require("child_process"); L8216: function detectCurrentBranch(cwd = process.cwd()) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L8202

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L92

11097if (process.platform === "win32") { L11098: return process.env.COMSPEC ?? "powershell.exe"; L11099: }

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L11097

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; import_node_readline3 = __toESM(require("readline")); const rl = import_node_readline3.default.createInterface({ input: stdin, crlfDelay: Infinity }); const rl = import_node_readline3.default.createInterface({ input: child.stdout, crlfDelay: Infinity }); async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) { const res = await fetchImpl(`${baseUrl}/api/${api}`, { headers: { Authorization: `Convex ${key}`, "Content-Type": "application/json" }

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

8202} L8203: process.stderr.write( L8204: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8205: ); ... L8214: // src/lib/git-branch.ts L8215: var import_child_process = require("child_process"); L8216: function detectCurrentBranch(cwd = process.cwd()) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L8202

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L92

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L312: } L313: async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) { L314: const res = await fetchImpl(`${baseUrl}/api/${api}`, { ... L3113: const tmp = `${debugFilePath}.${process.pid}.tmp`; L3114: fs.writeFileSync(tmp, header); L3115: fs.renameSync(tmp, debugFilePath);

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L92

10209package = codeam-cli; repositoryIdentity = codeagent-mobile-clients; dependency = chokidar L10209: try { L10210: return require("chokidar"); L10211: } catch {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L10209

8202Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L8202: } L8203: process.stderr.write( L8204: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8205: ); ... L8214: // src/lib/git-branch.ts L8215: var import_child_process = require("child_process"); L8216: function detectCurrentBranch(cwd = process.cwd()) {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L8202

14337fs12.writeFileSync(this.helperPath, PYTHON_PTY_HELPER, { mode: 420 }); L14338: this.proc = (0, import_child_process8.spawn)(python, [this.helperPath, cmd, ...args2], { L14339: stdio: ["pipe", "pipe", "inherit"], ... L14352: \u2717 Failed to launch Claude Code: ${err.message} L14353: Make sure claude is correctly installed: npm install -g @anthropic-ai/claude-code L14354: `

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L14337

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.71.1 matchedPath = dist/index.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d17e197fdcd15e9c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = codeam-cli@2.71.1 matchedPath = dist/index.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.1 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.71.1 matchedPath = dist/vendor/node-pty/lib/unixTerminal.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/unixTerminal.jsView on unpkg

dist/vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.71.1 matchedPath = dist/vendor/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg

Source & flagged code

20 flagged

package.jsonView file

Lines 4-44json

4 "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",

5 "type": "commonjs",

6 "main": "dist/index.js",

7 "bin": {

8 "codeam": "dist/index.js"

9 },

10 "files": [

11 "dist/index.js",

12 "dist/postinstall.js",

13 "dist/vendor",

14 "README.md",

15 "CHANGELOG.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsup && node scripts/vendor-node-pty.js",

20 "dev": "tsup --watch",

21 "test": "vitest run",

22 "test:coverage": "vitest run --coverage",

23 "typecheck": "tsc --noEmit",

24 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "e2e": "playwright test"

27 },

28 "keywords": [

29 "claude",

30 "claude-code",

31 "ai",

32 "ai-agent",

33 "ai-coding",

34 "ai-workflow",

35 "ai-workflow-continuity",

36 "async-ai-productivity",

37 "remote-ai-supervision",

38 "cli",

39 "developer-tools",

40 "devtools",

41 "codeagent",

42 "codeam",

43 "anthropic",

44 "openai-codex",

dist/index.jsView file

8203process.stderr.write( L8204: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8205: ); ... L8209: function vercelBypassHeader() { L8210: const token = process.env.CODEAM_VERCEL_BYPASS; L8211: return token ? { "x-vercel-protection-bypass": token } : {}; ... L8214: // src/lib/git-branch.ts L8215: var import_child_process = require("child_process"); L8216: function detectCurrentBranch(cwd = process.cwd()) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L8203

92Source sends the broad process environment to a literal external destination. L92: // src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L92

8202

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.71.1 matchedPath = dist/vendor/node-pty/lib/unixTerminal.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/unixTerminal.jsView on unpkg

dist/vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.71.1 matchedPath = dist/vendor/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg