codebolt@1.12.87
CodeBolt headless server CLI
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package presents as a headless server CLI, with no install-time hook in the inspected manifest. The flagged source excerpts fit bundled editor/compiler and provider-auth behavior; they do not establish an attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The CLI runs when invoked; the inspected manifest shows only a build task for prepublish.
Impact
No malicious impact was identified in the reviewed excerpts.
Mechanism
The flagged shell and HTML bundles contain language and compiler-related code, and the inspected token flow checks GitHub OAuth scopes.
AI rationale
The package presents as a headless server CLI, with no install-time hook in the inspected manifest. The flagged source excerpts fit bundled editor/compiler and provider-auth behavior; they do not establish an attack.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s `prepublishOnly` script runs the package build; no install hook appears in the inspected scripts.
- The `codebolt` executable loads the package’s CLI entrypoint.
- The flagged Bash asset identifies itself as a Bash language component and includes shell-variable names.
- The flagged HTML server bundle lists `child_process` among Node built-in module names; the excerpt shows no process launch.
- A bundled GitHub auth component uses a token to query OAuth scopes through its provider API.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicenseWildcardDependency
Source & flagged code
7 flaggeddist/web/assets/serverWorkerMain-CPdrTHxh.jsView file
2patternName = generic_password
severity = medium
line = 2
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/web/assets/serverWorkerMain-CPdrTHxh.jsView on unpkg · L21/*! For license information please see serverWorkerMain.js.LICENSE.txt */
L2: var serverExportVar;(()=>{var e={3608:(e,t,r)=>{"use strict";var n;function i(e){if("contents"in e)n="string"==typeof e.contents?JSON.parse(e.contents):e.contents;else if("fsPath"i...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/web/assets/serverWorkerMain-CPdrTHxh.jsView on unpkg · L1dist/web/assets/iconv-lite-umd-DpoLQuPU.jsView file
7contains invisible/control Unicode U+200B (zero width space)
\v\f\r\x1B !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟¢ﺀﺁﺃﺅﻊﺋﺍﺑﺓﺗﺛﺟﺣﺧﺩﺫﺭﺯﺳﺷﺻﺿﻁﻅﻋﻏ¦¬÷×ﻉـﻓﻗﻛﻟﻣﻧﻫﻭﻯﻳﺽﻌﻎﻍﻡﹽّﻥ
Findings
1 Critical2 High7 Medium8 Low
CriticalTrojan Source Unicodedist/web/assets/iconv-lite-umd-DpoLQuPU.js
HighCross File Remote Execution Contextdist/web/assets/htmlServerMain-BEIBCfWH.js
HighSemantic Analysis Limiteddist/web/assets/advancedFormat-01TlOrYh.js#virtual:normalized:round1
MediumSecret Patterndist/web/assets/serverWorkerMain-CPdrTHxh.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/web/assets/onig-Du5pRr7Y.wasm
MediumOversized Source Filedist/web/assets/vendor-monaco-7uIto7rp.js
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to codebolt@1.12.87.
See all versions of codebolt for other recorded verdicts.
- Review the evidence and your use of codebolt@1.12.87 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.