Loading npm security reports…

icoa-cli@2.19.561: Malicious npm security report (Block) | LPM Firewall

registry / icoa-cli / 2.19.561

icoa-cli@2.19.561

ICOA CLI — AI-native competition runtime of the International Cyber Olympiad in AI: learn, practise, and compete in AI & cybersecurity from the terminal (AI4CTF · CTF4AI · CTF4EAI)

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The package acts as a remote proctoring client that collects local command activity and installed AI-tool names. It also contains an obfuscated path for executing shell commands.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting the CLI and using its exam, interactive shell, or CTF4AI features.

Impact

A remote service can receive command input, working directories, device-linked identity data, and detected AI tools; the hidden command path can run arbitrary local commands.

Mechanism

Local activity collection, remote audit uploads, and hidden shell execution.

Attack narrative

When its competition features run, the package inventories installed AI command-line tools and sends the results to its server. Its interactive shell records user input and working directories, while a background task uploads session-log entries with device and account-linked identifiers. Separately, an obfuscated CTF4AI handler executes bang-prefixed input through execSync. These capabilities exceed ordinary CLI operation and create a concrete surveillance and arbitrary-command-execution surface.

Rationale

Source inspection confirms runtime collection and exfiltration of local activity and AI-tool inventory, plus an obfuscated arbitrary shell execution path. The absence of install hooks does not remove the concrete runtime attack surface.

Evidence

dist/lib/exam-sandbox.jsdist/lib/log-sync.jsdist/repl.jsdist/commands/exam.jsdist/commands/ctf4ai-demo.js~/.icoa/exam-audit.log~/.icoa/session.log

Source & flagged code

15 flagged · loading source

dist/commands/gpufortask.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = import{c...}})}

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/gpufortask.jsView on unpkg · L1

dist/repl.jsView file

1import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{appendExitLog as n}from"./lib/exit-log.js";...

High

Child Process

Package source references child process execution.

dist/repl.jsView on unpkg · L1

1import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{appendExitLog as n}from"./lib/exit-log.js";...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/repl.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js -> dist/repl.js L1: import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{appendExitLog as n}from"./lib/exit-log.js";...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/repl.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.559 matchedPath = dist/repl.js matchedIdentity = npm:aWNvYS1jbGk:2.19.559 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/repl.jsView on unpkg

dist/commands/ctf4ai-demo.jsView file

1(function(b,f){const U=a0f,h=b();while(!![]){try{const j=parseInt(U(0x206))/(0x202d*-0x1+-0x1d*0x71+0x2cfb)+-parseInt(U(0x1df))/(-0x1506+0x1*0x2d9+0x122f*0x1)*(-parseInt(U(0x185))/...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/commands/ctf4ai-demo.jsView on unpkg · L1

1(function(b,f){const U=a0f,h=b();while(!![]){try{const j=parseInt(U(0x206))/(0x202d*-0x1+-0x1d*0x71+0x2cfb)+-parseInt(U(0x1df))/(-0x1506+0x1*0x2d9+0x122f*0x1)*(-parseInt(U(0x185))/...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/ctf4ai-demo.jsView on unpkg · L1

dist/lib/exam-sandbox.jsView file

1import{mkdtempSync as t,mkdirSync as e,existsSync as o,appendFileSync as s,statSync as i}from"node:fs";import{execFileSync as n}from"node:child_process";import{tmpdir as r,homedir ...

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/lib/exam-sandbox.jsView on unpkg · L1

dist/lib/tool-man.jsView file

1import chalk from"chalk";export const TOOL_DOCS=[{name:"file",cat:"Forensics",summary:"identify a file type (always step 1)",ex:[["file mystery","what is this really? (extension li...

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/lib/tool-man.jsView on unpkg · L1

1Trigger-reachable chain: scripts.start -> dist/index.js -> dist/repl.js -> dist/lib/tool-man.js L1: import chalk from"chalk";export const TOOL_DOCS=[{name:"file",cat:"Forensics",summary:"identify a file type (always step 1)",ex:[["file mystery","what is this really? (extension li...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/lib/tool-man.jsView on unpkg · L1

dist/commands/aienv.jsView file

1import{execSync as o,spawn as n}from"node:child_process";import{existsSync as e,readFileSync as t,writeFileSync as r}from"node:fs";import{homedir as s}from"node:os";import chalk fr...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/aienv.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.559 matchedPath = dist/commands/aienv.js matchedIdentity = npm:aWNvYS1jbGk:2.19.559 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/aienv.jsView on unpkg

dist/commands/env.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.559 matchedPath = dist/commands/env.js matchedIdentity = npm:aWNvYS1jbGk:2.19.559 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/env.jsView on unpkg

dist/commands/gfssm.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.559 matchedPath = dist/commands/gfssm.js matchedIdentity = npm:aWNvYS1jbGk:2.19.559 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/gfssm.jsView on unpkg

dist/commands/ioailab.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.559 matchedPath = dist/commands/ioailab.js matchedIdentity = npm:aWNvYS1jbGk:2.19.559 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/ioailab.jsView on unpkg

Source & flagged code

15 flagged

dist/commands/gpufortask.jsView file

Lines 1-1javascript

1import{createInterface as e,Interface as o}from"node:readline";import chalk from"chalk";import{getDeviceFingerprint as t}from"../lib/access.js";import{getMainRl as n}from"../lib/main-rl.js";const s=(process.env.ICOA_GPUTASK_SERVER||"https://practice.icoa2026.au").replace(/\/$/,"");let i=[],a=null,l=null;function r(o){return new Promise(t=>{const s=n();if(s)return l=t,s.setPrompt(o),void s.prompt();const i=e({input:process.stdin,output:process.stdout});i.question(o,e=>{i.close(),t(e)})})}let c="en";const g={banner:{en:"[🧪 Committee GPU sandbox — clean 40-pkg IOAI environment]",zh:"[🧪 命题组 GP ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/gpufortask.jsView on unpkg · L1

Long lines were clipped for display.

dist/repl.jsView file

Lines 1-1javascript

1import{createInterface as o}from"node:readline";import{spawn as e,execSync as t}from"node:child_process";import chalk from"chalk";import{appendExitLog as n}from"./lib/exit-log.js";import

dist/commands/ctf4ai-demo.jsView file

Lines 1-1javascript

1(function(b,f){const U=a0f,h=b();while(!![]){try{const j=parseInt(U

dist/lib/exam-sandbox.jsView file

Lines 1-1javascript

1import{mkdtempSync as t,mkdirSync as e,existsSync as o,appendFileSync as s,statSync as i}from"node:fs";import{execFileSync as n}from"node:child_process";import{tmpdir as r,homedir as a,platform

dist/lib/tool-man.jsView file

Lines 1-1javascript

1import chalk from"chalk";export const TOOL_DOCS=[{name:"file",cat:"Forensics",summary:"identify a file type (always step 1)",ex:[["file mystery","what is this really? (extension lies)"]]},{name:"strings",cat:"Forensics",summary:"pull printable text out of any binary"

dist/commands/aienv.jsView file

Lines 1-1javascript

1import{execSync as o,spawn as n}from"node:child_process";import{existsSync as e,readFileSync as t,writeFileSync as r}from"node:fs";import{homedir as s}from"node:os";import

dist/commands/env.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.559 matchedPath = dist/commands/env.js matchedIdentity = npm:aWNvYS1jbGk:2.19.559 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/env.jsView on unpkg

dist/commands/gfssm.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.559 matchedPath = dist/commands/gfssm.js matchedIdentity = npm:aWNvYS1jbGk:2.19.559 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/gfssm.jsView on unpkg

dist/commands/ioailab.jsView file

•matchType = normalized_sha256 matchedPackage = icoa-cli@2.19.559 matchedPath = dist/commands/ioailab.js matchedIdentity = npm:aWNvYS1jbGk:2.19.559 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/ioailab.jsView on unpkg