Loading npm security reports…

icoa-cli@2.19.541: Malicious npm security report (Block) | LPM Firewall

registry / icoa-cli / 2.19.541

icoa-cli@2.19.541

ICOA CLI — AI-native competition runtime of the International Cyber Olympiad in AI: learn, practise, and compete in AI & cybersecurity from the terminal (AI4CTF · CTF4AI · CTF4EAI)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

During normal interactive/exam use, the CLI inventories AI tools and uploads user-entered shell commands with identifying and exam-token data. Commands accessing home directories or shell history are explicitly classified and sent to the same service.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Run the CLI REPL or exam workflow and enter a command.

Impact

Disclosure of sensitive command contents, filesystem intent, installed AI tooling, device identifier, and exam token.

Mechanism

Remote exfiltration of command input, environment-derived identity, and AI-tool inventory.

Attack narrative

The CLI's exam support scans PATH for named AI-agent executables and sends the results remotely. Its REPL sends each supplied command, including commands flagged for reading home directories or shell history, together with cwd, device fingerprint, and an exam token. This creates a concrete credential and local-command exfiltration path during ordinary interactive use; no lifecycle trigger is required.

Rationale

Source directly implements remote transmission of sensitive interactive-command and identity data, not merely package-aligned challenge submission. The absence of an install hook does not remove the runtime exfiltration behavior.

Evidence

package.jsondist/repl.jsdist/lib/exam-sandbox.jsdist/commands/exam.js~/.icoa/exam-audit.log~/.icoa-workspace

Network endpoints2

/api/icoa/exam-audit

Source & flagged code

14 flagged · loading source

dist/repl.jsView file

1import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{appendExitLog as n}from"./lib/exit-log.js";...

High

Child Process

Package source references child process execution.

dist/repl.jsView on unpkg · L1

1import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{appendExitLog as n}from"./lib/exit-log.js";...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/repl.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/repl.js L1: import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{appendExitLog as n}from"./lib/exit-log.js";...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/repl.jsView on unpkg · L1

dist/commands/ctf4ai-demo.jsView file

1(function(b,f){const U=a0f,h=b();while(!![]){try{const j=parseInt(U(0x1b7))/(-0x398+0x15a9*0x1+-0x1210)+-parseInt(U(0x23d))/(-0x87e*0x1+-0x1779+0x1ff9)*(parseInt(U(0x261))/(-0x16c6...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/commands/ctf4ai-demo.jsView on unpkg · L1

1(function(b,f){const U=a0f,h=b();while(!![]){try{const j=parseInt(U(0x1b7))/(-0x398+0x15a9*0x1+-0x1210)+-parseInt(U(0x23d))/(-0x87e*0x1+-0x1779+0x1ff9)*(parseInt(U(0x261))/(-0x16c6...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/ctf4ai-demo.jsView on unpkg · L1

dist/lib/exam-sandbox.jsView file

1import{mkdtempSync as t,mkdirSync as e,existsSync as o,appendFileSync as s,statSync as i}from"node:fs";import{execFileSync as n}from"node:child_process";import{tmpdir as r,homedir ...

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/lib/exam-sandbox.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.490 matchedPath = dist/lib/exam-sandbox.js matchedIdentity = npm:aWNvYS1jbGk:2.19.490 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/exam-sandbox.jsView on unpkg

dist/lib/tool-man.jsView file

1import chalk from"chalk";export const TOOL_DOCS=[{name:"file",cat:"Forensics",summary:"identify a file type (always step 1)",ex:[["file mystery","what is this really? (extension li...

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/lib/tool-man.jsView on unpkg · L1

1Trigger-reachable chain: scripts.start -> dist/index.js -> dist/repl.js -> dist/lib/tool-man.js L1: import chalk from"chalk";export const TOOL_DOCS=[{name:"file",cat:"Forensics",summary:"identify a file type (always step 1)",ex:[["file mystery","what is this really? (extension li...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/lib/tool-man.jsView on unpkg · L1

dist/commands/gfssm.jsView file

1import{execFile as e}from"node:child_process";import{mkdir as o,writeFile as n}from"node:fs/promises";import{homedir as t}from"node:os";import{join as r}from"node:path";import{crea...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/gfssm.jsView on unpkg · L1

dist/commands/aienv.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.490 matchedPath = dist/commands/aienv.js matchedIdentity = npm:aWNvYS1jbGk:2.19.490 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/aienv.jsView on unpkg

dist/commands/env.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.490 matchedPath = dist/commands/env.js matchedIdentity = npm:aWNvYS1jbGk:2.19.490 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/env.jsView on unpkg

dist/commands/ioailab.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.490 matchedPath = dist/commands/ioailab.js matchedIdentity = npm:aWNvYS1jbGk:2.19.490 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/ioailab.jsView on unpkg

dist/commands/teleload.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.490 matchedPath = dist/commands/teleload.js matchedIdentity = npm:aWNvYS1jbGk:2.19.490 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/teleload.jsView on unpkg

Source & flagged code

14 flagged

dist/repl.jsView file

Lines 1-1javascript

1import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{appendExitLog as n}from"./lib/exit-log.js";import{dispatchable as l,helpRows as s,shortcutFor as a,subcommandsOf as r,surface as i}from"./lib/commands.js";import{distance as c}from"fastest-levenshtein";import{isConnected as g,getConfig as y,saveConfig as d}from"./lib/config.js";import{ensureLangCache as m}from"./lib/translations-fetcher.js";import{loadUiPack as u}from"./lib/i18n.js";import{isActivated as p,activateToken as h,isFreeCommand as f,isDeviceMatch a ...

High

Child Process

Package source references child process execution.

dist/repl.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/repl.jsView on unpkg · L1

Long lines were clipped for display.

1Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/repl.js L1: import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{appendExitLog as n}from"./lib/exit-log.js";...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/repl.jsView on unpkg · L1

dist/commands/ctf4ai-demo.jsView file

Lines 1-1javascript

1(function(b,f){const U=a0f,h=b();while(!![]){try{const j=parseInt(U

dist/lib/exam-sandbox.jsView file

Lines 1-1javascript

1import{mkdtempSync as t,mkdirSync as e,existsSync as o,appendFileSync as s,statSync as i}from"node:fs";import{execFileSync as n}from"node:child_process";import{tmpdir as r,homedir as a,platform

dist/lib/tool-man.jsView file

Lines 1-1javascript

1import chalk from"chalk";export const TOOL_DOCS=[{name:"file",cat:"Forensics",summary:"identify a file type (always step 1)",ex:[["file mystery","what is this really? (extension lies)"]]},{name:"strings",cat:"Forensics",summary:"pull printable text out of any binary"

dist/commands/gfssm.jsView file

Lines 1-1javascript

1import{execFile as e}from"node:child_process";import{mkdir as o,writeFile as n}from"node:fs/promises";import{homedir as t}from"node:os";import{join as r}from"node:path"

dist/commands/aienv.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.490 matchedPath = dist/commands/aienv.js matchedIdentity = npm:aWNvYS1jbGk:2.19.490 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/aienv.jsView on unpkg

dist/commands/env.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.490 matchedPath = dist/commands/env.js matchedIdentity = npm:aWNvYS1jbGk:2.19.490 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/env.jsView on unpkg

dist/commands/ioailab.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.490 matchedPath = dist/commands/ioailab.js matchedIdentity = npm:aWNvYS1jbGk:2.19.490 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/ioailab.jsView on unpkg

dist/commands/teleload.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.490 matchedPath = dist/commands/teleload.js matchedIdentity = npm:aWNvYS1jbGk:2.19.490 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/teleload.jsView on unpkg