codebolt@1.12.89
CodeBolt headless server CLI
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package is a CLI with bundled editor assets; the reviewed scanner flags correspond to ordinary editor functionality and shell syntax grammar. Its automatic update check requests the latest version from npm, while the inspected GitHub token flow prompts the user and validates the token against GitHub.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
CLI invocation; GitHub authentication requires an explicit user action.
Impact
No automatic collection or transmission of host, project, or credential data was identified.
Mechanism
The CLI checks npm for a newer version and caches the result. The editor’s GitHub token flow prompts the user and checks token scopes against GitHub.
AI rationale
The package is a CLI with bundled editor assets; the reviewed scanner flags correspond to ordinary editor functionality and shell syntax grammar. Its automatic update check requests the latest version from npm, while the inspected GitHub token flow prompts the user and validates the token against GitHub.
Evidence
~/.codebolt/update-check.json$TMPDIR/cli-debug.log<project>/.codebolt.log
Network endpoints2
registry.npmjs.orgapi.github.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as a headless server CLI whose main entry and executable point to the bundled CLI.
- The CLI wrapper only loads the declared main entry.
- The bundled GitHub authentication flow asks the user to create and paste a personal access token.
- The token scope check targets the configured GitHub API URI.
Evidence against
- The only declared lifecycle hook is prepublishOnly, which runs a package build rather than install-time code.
- The inspected automatic update check fetches the latest package version from npm’s registry and caches the result locally; it does not send host or project data.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
7 flaggeddist/web/assets/serverWorkerMain-CPdrTHxh.jsView file
2patternName = generic_password
severity = medium
line = 2
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/web/assets/serverWorkerMain-CPdrTHxh.jsView on unpkg · L21/*! For license information please see serverWorkerMain.js.LICENSE.txt */
L2: var serverExportVar;(()=>{var e={3608:(e,t,r)=>{"use strict";var n;function i(e){if("contents"in e)n="string"==typeof e.contents?JSON.parse(e.contents):e.contents;else if("fsPath"i...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/web/assets/serverWorkerMain-CPdrTHxh.jsView on unpkg · L1dist/web/assets/iconv-lite-umd-DpoLQuPU.jsView file
7contains invisible/control Unicode U+200B (zero width space)
\v\f\r\x1B !"#$٪&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~°·∙√▒─│┼┤┬├┴┐┌└┘β∞φ±½¼≈«»ﻷﻸ��ﻻﻼ� ﺂ£¤ﺄ��ﺎﺏﺕﺙ،ﺝﺡﺥ٠١٢٣٤٥٦٧٨٩ﻑ؛ﺱﺵﺹ؟¢ﺀﺁﺃﺅﻊﺋﺍﺑﺓﺗﺛﺟﺣﺧﺩﺫﺭﺯﺳﺷﺻﺿﻁﻅﻋﻏ¦¬÷×ﻉـﻓﻗﻛﻟﻣﻧﻫﻭﻯﻳﺽﻌﻎﻍﻡﹽّﻥ
Findings
1 Critical2 High7 Medium8 Low
CriticalTrojan Source Unicodedist/web/assets/iconv-lite-umd-DpoLQuPU.js
HighCross File Remote Execution Contextdist/web/assets/htmlServerMain-BEIBCfWH.js
HighSemantic Analysis Limiteddist/web/assets/elk.bundled-DED6nYWl.js
MediumSecret Patterndist/web/assets/serverWorkerMain-CPdrTHxh.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/web/assets/onig-Du5pRr7Y.wasm
MediumOversized Source Filedist/web/assets/vendor-monaco-7uIto7rp.js
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
Affected versions and remediation
This report applies to codebolt@1.12.89.
See all versions of codebolt for other recorded verdicts.
- Review the evidence and your use of codebolt@1.12.89 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.