codebolt@1.12.86
CodeBolt headless server CLI
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package is a CLI/server that bundles editor assets, and the inspected credential flow uses GitHub functionality. The static indicators did not establish Trojan Source behavior, unrelated credential collection, or another concrete attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs when a user invokes `codebolt`; the inspected GitHub token operations are part of bundled editor authentication.
Impact
No malicious impact was identified from the reviewed source.
Mechanism
The inspected token request is directed to GitHub authentication functionality. No unrelated credential transfer or harmful automatic action was established.
AI rationale
The package is a CLI/server that bundles editor assets, and the inspected credential flow uses GitHub functionality. The static indicators did not establish Trojan Source behavior, unrelated credential collection, or another concrete attack.
Network endpoints4
github.comcode.visualstudio.comgo.microsoft.cominsiders.vscode.dev
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes CodeBolt as a headless server CLI and declares its CLI entry point.
- The executable forwards to the bundled CLI.
- A bundled editor asset contains a GitHub OAuth token exchange, and another uses the token in an Authorization header for a GitHub API request.
- The flagged editor assets include Microsoft VS Code repository metadata, consistent with bundled editor functionality.
Evidence against
- The manifest's `prepublishOnly` script runs a build; no install lifecycle hook is declared.
- The credential-related code inspected uses a GitHub token with GitHub functionality; no unrelated credential collection or exfiltration was identified.
- The flagged assets are bundled editor code; the scanner's Unicode and dynamic-code indicators did not establish malicious behavior.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
7 flaggeddist/web/assets/serverWorkerMain-CPdrTHxh.jsView file
2patternName = generic_password
severity = medium
line = 2
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/web/assets/serverWorkerMain-CPdrTHxh.jsView on unpkg · L21/*! For license information please see serverWorkerMain.js.LICENSE.txt */
L2: var serverExportVar;(()=>{var e={3608:(e,t,r)=>{"use strict";var n;function i(e){if("contents"in e)n="string"==typeof e.contents?JSON.parse(e.contents):e.contents;else if("fsPath"i...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/web/assets/serverWorkerMain-CPdrTHxh.jsView on unpkg · L1dist/web/assets/iconv-lite-umd-DpoLQuPU.jsView file
7contains invisible/control Unicode U+200B (zero width space)
\v\f\r\x1B !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟¢ﺀﺁﺃﺅﻊﺋﺍﺑﺓﺗﺛﺟﺣﺧﺩﺫﺭﺯﺳﺷﺻﺿﻁﻅﻋﻏ¦¬÷×ﻉـﻓﻗﻛﻟﻣﻧﻫﻭﻯﻳﺽﻌﻎﻍﻡﹽّﻥ
Findings
1 Critical2 High7 Medium8 Low
CriticalTrojan Source Unicodedist/web/assets/iconv-lite-umd-DpoLQuPU.js
HighCross File Remote Execution Contextdist/web/assets/htmlServerMain-BEIBCfWH.js
HighSemantic Analysis Limiteddist/web/assets/advancedFormat-01TlOrYh.js#virtual:normalized:round1
MediumSecret Patterndist/web/assets/serverWorkerMain-CPdrTHxh.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/web/assets/onig-Du5pRr7Y.wasm
MediumOversized Source Filedist/web/assets/vendor-monaco-7uIto7rp.js
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to codebolt@1.12.86.
See all versions of codebolt for other recorded verdicts.
- Review the evidence and your use of codebolt@1.12.86 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.