contextbase-coding-agents
ContextBase long-term memory for coding agents; remote connection required.
This report shows the evidence for contextbase-coding-agents@1.0.0. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package silently launches a paid-capable local agent for first-time repository seeding by default, using the user’s existing CLI authentication without an explicit survey request. The $2 Claude budget cap limits the charge but does not provide consent for the automatic spend.
Static reason
One or more suspicious static signals were detected.
Trigger
A hook runs in a project with no stored git records while autoSeed and codebaseSurvey remain at their defaults.
Impact
An unrequested survey can use the user’s existing CLI authentication and incur charges, up to the configured Claude budget cap.
Mechanism
The package starts an installed agent CLI non-interactively; the Claude path supplies --max-budget-usd 2 and suppresses subprocess output.
Attack narrative
With default settings, a hook in a project lacking stored git records starts a repository survey without asking the user. The package searches for an installed coding-agent CLI and runs it non-interactively; the Claude path uses the user’s logged-in account with a default $2 budget cap. This can spend the user’s funds through existing CLI authentication. The subprocess output is suppressed, and the survey is designed to store findings in the configured memory service.
AI rationale
The package silently launches a paid-capable local agent for first-time repository seeding by default, using the user’s existing CLI authentication without an explicit survey request. The $2 Claude budget cap limits the charge but does not provide consent for the automatic spend.
Evidence
dist/zcode-hook.jsdist/kilo.jsdist/survey-supervisor.js
Network endpoints1
User-configured API URL: /v1/default/banks/{bank}/...; the package contains no fixed service host.
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- Hook configuration defaults autoSeed and codebaseSurvey to enabled, selects haiku, and sets surveyBudgetUsd to 2.
- When a project has no existing git records, the seeding path calls the survey runner automatically.
- The Claude survey command runs non-interactively with --max-budget-usd defaulting to 2; its allowed tools include reading and ContextBase ingestion.
- A supervisor launches the selected CLI with output ignored, while the supervisor itself is detached.
- The package is intended to connect to a user-provided memory service, and its bearer token is sent to the configured API URL.
Evidence against
- The survey is a one-time repository-seeding feature aligned with the package’s stated coding-agent memory purpose.
- The Claude survey restricts tools and sets a spending cap, and the memory API endpoint is configured by the user.
Behavioral surface
ChildProcessEnvironmentVarsEvalNetwork
HighEntropyStrings
Source & flagged code
8 flaggeddist/zcode-hook.jsView file
3`)}catch{}}var f={debug:(e,t,n)=>ee("debug",e,t,n),info:(e,t,n)=>ee("info",e,t,n),warn:(e,t,n)=>ee("warn",e,t,n),error:(e,t,n)=>ee("error",e,t,n)};function A(e,t=200){let n=[],r=ne...
L4: `)}catch{}}function ar(e,t){let n=t.replace(/^(?:|)+/,"");if(!n.trim())return null;try{let r=JSON.parse(n);if(r&&typeof r=="object"&&!Array.isArray(r))return r;g(e,"hook_input_...
L5:
High
1#!/usr/bin/env node
L2: import{existsSync as ts}from"fs";import{existsSync as wr}from"fs";import{homedir as Tr}from"os";import{basename as se,dirname as Pe,join as _r,normalize as ie,sep as wt}from"path";...
L3: `)}catch{}}var f={debug:(e,t,n)=>ee("debug",e,t,n),info:(e,t,n)=>ee("info",e,t,n),warn:(e,t,n)=>ee("warn",e,t,n),error:(e,t,n)=>ee("error",e,t,n)};function A(e,t=200){let n=[],r=ne...
L4: `)}catch{}}function ar(e,t){let n=t.replace(/^(?:|)+/,"");if(!n.trim())return null;try{let r=JSON.parse(n);if(r&&typeof r=="object"&&!Array.isArray(r))return r;g(e,"hook_input_...
L5:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/zcode-hook.jsView on unpkg · L1Findings
1 Critical6 High3 Medium3 Low
CriticalRemote Response Code Executiondist/kilo.js
HighChild Processdist/zcode-hook.js
HighEvaldist/mcp-server.js
HighSame File Env Network Executiondist/zcode-hook.js
HighCommand Output Exfiltrationdist/kilo.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limitedcordis.patch.yml
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptodist/kilo.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to contextbase-coding-agents@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing contextbase-coding-agents@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.