Loading npm security reports…

codeam-cli@2.74.1: Malicious npm security report (Block) | LPM Firewall

registry / codeam-cli / 2.74.1

codeam-cli@2.74.1

Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

After a user pairs a mobile device, the CLI silently reads local agent credentials and uploads them to its service. Starting the CLI also opens a remote command channel.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Run codeam pair, then complete mobile pairing; remote control activates when the CLI is started.

Impact

The service receives local AI-agent credentials without a separate link confirmation and can control the paired session.

Mechanism

Automatic credential extraction and upload followed by a remote command relay.

Attack narrative

The pair command invokes autoLinkAfterPair after mobile pairing. That routine obtains a credential locator, extracts a local token, and posts the token and optional agent state to the CodeAgent Mobile API. This bypasses the separate explicit link command and provides the remote service with credentials needed to operate the paired agent. The running CLI then connects to a server-supplied command stream.

Rationale

The package performs concrete credential collection and transmission automatically after pairing, without a separate user confirmation. Its benign postinstall message does not mitigate that runtime exfiltration path.

Evidence

dist/index.js~/.codeam/config.jsonlocal agent credential locations

Network endpoints1

api.codeagent-mobile.com

Decision evidence

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

8247process.stderr.write( L8248: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8249: ); ... L8253: function vercelBypassHeader() { L8254: const token = process.env.CODEAM_VERCEL_BYPASS; L8255: return token ? { "x-vercel-protection-bypass": token } : {}; ... L8258: // src/lib/git-branch.ts L8259: var import_child_process = require("child_process"); L8260: function detectCurrentBranch(cwd = process.cwd()) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L8247

92Source sends the broad process environment to a literal external destination. L92: // src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L92

1809Trigger-reachable chain: manifest.main -> dist/index.js L1809: // Verified 2026-09-03 over MCP with a dummy key (`tools/list` → 162, no L1810: // licence gate, no paywall on stderr) and supply-chain audited from the L1811: // tarball: the only network hosts are api.clickup.com / L1812: // developer.clickup.com, no child_process/eval, deps = MCP SDK, axios, L1813: // zod, dotenv, form-data. Young package (2 releases, one author) — the L1814: // pin is EXACT and the licence audit watches every bump.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1809

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L92

11141if (process.platform === "win32") { L11142: return process.env.COMSPEC ?? "powershell.exe"; L11143: }

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L11141

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; import_node_readline3 = __toESM(require("readline")); const rl = import_node_readline3.default.createInterface({ input: stdin, crlfDelay: Infinity }); const rl = import_node_readline3.default.createInterface({ input: child.stdout, crlfDelay: Infinity }); async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) { const res = await fetchImpl(`${baseUrl}/api/${api}`, { headers: { Authorization: `Convex ${key}`, "Content-Type": "application/json" }

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

1809// Verified 2026-09-03 over MCP with a dummy key (`tools/list` → 162, no L1810: // licence gate, no paywall on stderr) and supply-chain audited from the L1811: // tarball: the only network hosts are api.clickup.com / L1812: // developer.clickup.com, no child_process/eval, deps = MCP SDK, axios, L1813: // zod, dotenv, form-data. Young package (2 releases, one author) — the L1814: // pin is EXACT and the licence audit watches every bump.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1809

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L92

92// src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L312: } L313: async function adminQuery(baseUrl, key, api, body, fetchImpl = fetch) { L314: const res = await fetchImpl(`${baseUrl}/api/${api}`, { ... L3157: const tmp = `${debugFilePath}.${process.pid}.tmp`; L3158: fs.writeFileSync(tmp, header); L3159: fs.renameSync(tmp, debugFilePath);

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L92

10253package = codeam-cli; repositoryIdentity = codeagent-mobile-clients; dependency = chokidar L10253: try { L10254: return require("chokidar"); L10255: } catch {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L10253

1809Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1809: // Verified 2026-09-03 over MCP with a dummy key (`tools/list` → 162, no L1810: // licence gate, no paywall on stderr) and supply-chain audited from the L1811: // tarball: the only network hosts are api.clickup.com / L1812: // developer.clickup.com, no child_process/eval, deps = MCP SDK, axios, L1813: // zod, dotenv, form-data. Young package (2 releases, one author) — the L1814: // pin is EXACT and the licence audit watches every bump.

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1809

14388fs12.writeFileSync(this.helperPath, PYTHON_PTY_HELPER, { mode: 420 }); L14389: this.proc = (0, import_child_process8.spawn)(python, [this.helperPath, cmd, ...args2], { L14390: stdio: ["pipe", "pipe", "inherit"], ... L14403: \u2717 Failed to launch Claude Code: ${err.message} L14404: Make sure claude is correctly installed: npm install -g @anthropic-ai/claude-code L14405: `

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L14388

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.71.2 matchedPath = dist/index.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d17e197fdcd15e9c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = codeam-cli@2.71.2 matchedPath = dist/index.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.2 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.71.2 matchedPath = dist/vendor/node-pty/lib/unixTerminal.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/unixTerminal.jsView on unpkg

dist/vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.71.2 matchedPath = dist/vendor/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg

Source & flagged code

20 flagged

package.jsonView file

Lines 4-44json

4 "description": "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device — async. The terminal companion for CodeAgent Mobile.",

5 "type": "commonjs",

6 "main": "dist/index.js",

7 "bin": {

8 "codeam": "dist/index.js"

9 },

10 "files": [

11 "dist/index.js",

12 "dist/postinstall.js",

13 "dist/vendor",

14 "README.md",

15 "CHANGELOG.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "build": "tsup && node scripts/vendor-node-pty.js",

20 "dev": "tsup --watch",

21 "test": "vitest run",

22 "test:coverage": "vitest run --coverage",

23 "typecheck": "tsc --noEmit",

24 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "prepublishOnly": "npm run build",

26 "e2e": "playwright test"

27 },

28 "keywords": [

29 "claude",

30 "claude-code",

31 "ai",

32 "ai-agent",

33 "ai-coding",

34 "ai-workflow",

35 "ai-workflow-continuity",

36 "async-ai-productivity",

37 "remote-ai-supervision",

38 "cli",

39 "developer-tools",

40 "devtools",

41 "codeagent",

42 "codeam",

43 "anthropic",

44 "openai-codex",

dist/index.jsView file

8247process.stderr.write( L8248: "\n codeam-cli sends anonymous + identified usage events to PostHog\n (same project as the mobile + web apps). Opt out at any time:\n export CODEAM_TELEMETRY=0\n See https://... L8249: ); ... L8253: function vercelBypassHeader() { L8254: const token = process.env.CODEAM_VERCEL_BYPASS; L8255: return token ? { "x-vercel-protection-bypass": token } : {}; ... L8258: // src/lib/git-branch.ts L8259: var import_child_process = require("child_process"); L8260: function detectCurrentBranch(cwd = process.cwd()) {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L8247

92Source sends the broad process environment to a literal external destination. L92: // src/integrations/stdio-proxy.ts L93: var import_node_child_process33, import_node_readline3, RESTART_CHECK_INTERVAL_MS, SIGKILL_ESCALATION_MS, TOOL_CALL_TIMEOUT_MS, REPLAY_INIT_ID, RestartableStdioProxy; L94: var init_stdio_proxy = __esm({ ... L101: TOOL_CALL_TIMEOUT_MS = (() => { L102: const raw = Number(process.env.CODEAM_MCP_TOOL_TIMEOUT_MS); L103: return Number.isFinite(raw) && raw > 0 ? raw : 12e4; ... L116: toolTimers = /* @__PURE__ */ new Map(); L117: stdout = null; L118: swapping = false; ... L127: rl.on("line", (line) => this.onClientLine(line)); L128: rl.on("close", () => this.child?.stdin?.end()); L129: const timer = setInterval(() => this.checkRestart(stdout), RESTART_CHECK_INTERVAL_MS);

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L92

1809

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView file

•path = dist/vendor/node-pty/prebuilds/win32-arm64/pty.node kind = native_binary sizeBytes = 293376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/node-pty/prebuilds/win32-arm64/pty.nodeView on unpkg

dist/vendor/node-pty/lib/unixTerminal.jsView file

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.71.2 matchedPath = dist/vendor/node-pty/lib/unixTerminal.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/unixTerminal.jsView on unpkg

dist/vendor/node-pty/lib/windowsPtyAgent.jsView file

•matchType = normalized_sha256 matchedPackage = codeam-cli@2.71.2 matchedPath = dist/vendor/node-pty/lib/windowsPtyAgent.js matchedIdentity = npm:Y29kZWFtLWNsaQ:2.71.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/vendor/node-pty/lib/windowsPtyAgent.jsView on unpkg