registry / Credential exfiltration / mano-coding
mano-coding
Mano Coding CLI and toolchain
This report shows the evidence for mano-coding@0.1.63. 4 of 28 known versions are blocked or flagged. The newest version, 0.1.64, is flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe resolver’s global-token fallback is not scoped to the request host, and registry metadata can direct the subsequent tarball request to another host. That creates a concrete credential disclosure path when users resolve packages with an npm token in the environment.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user invokes package resolution while a global npm token is set, and registry metadata supplies a tarball URL on another host.
Impact
A malicious registry or package publisher could obtain the user’s npm token.
Mechanism
The resolver falls back to environment tokens without host scoping, applies the result to the metadata-provided tarball URL, then sends it as an Authorization header.
Attack narrative
During npm package resolution, the resolver takes the tarball URL from registry metadata and looks up authorization for it. If no host-matched npmrc credential applies, it falls back to a global npm token and the tarball downloader sends that value in an Authorization header. A registry or publisher that supplies a foreign tarball host could therefore capture the token.
AI rationale
The resolver’s global-token fallback is not scoped to the request host, and registry metadata can direct the subsequent tarball request to another host. That creates a concrete credential disclosure path when users resolve packages with an npm token in the environment.
Evidence
dist/bin.js
Network endpoints2
registry.npmjs.org/Registry metadata-provided dist.tarball URL (host not restricted in this flow)
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- NPM_TOKEN, NPM_AUTH_TOKEN, or MANO_NPM_AUTH_TOKEN is used as a fallback without checking whether the request host matches the token’s registry.
- The npm resolver takes the tarball URL from registry metadata and resolves authorization for that URL.
- The tarball downloader sends the resolved authorization value in an HTTP Authorization header.
Evidence against
- The package has no lifecycle scripts; the risky flow is in the CLI’s package-resolution behavior.
- Authorization entries from npm configuration are scoped to the request host and path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/bin.jsView file
1159var EventEmitter = __require("node:events").EventEmitter;
L1160: var childProcess = __require("node:child_process");
L1161: var path3 = __require("node:path");
High
1999}
L2000: const execArgv = process4.execArgv ?? [];
L2001: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
72892init_self_upgrade_pipeline();
L72893: DEFAULT_NPM_REGISTRY2 = "https://registry.npmjs.org";
L72894: }
...
L72897: // packages/cli/src/commands/auto-update.ts
L72898: import { spawn as spawn9 } from "node:child_process";
L72899: import { homedir as homedir8 } from "node:os";
...
L72901: async function scheduleAutoUpdateWorker(argv, currentVersion, options) {
L72902: const disabled = argv.includes("--offline") || Boolean(process.env["AICODING_NO_UPDATE_CHECK"]) || Boolean(process.env["CI"]) || argv[2] === "self-upgrade" || argv[2] === "_self-up...
L72903: if (disabled) return;
High
Same File Env Network Execution
Findings
6 High3 Medium6 Low
HighChild Processdist/bin.js
HighShelldist/bin.js
HighSame File Env Network Executiondist/bin.js
HighCommand Output Exfiltrationdist/bin.js
HighKnown Malware Source Similaritydist/bin.js
HighKnown Malware Source Fingerprint Signaturedist/bin.js
MediumDynamic Requirebin/mano-coding.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/bin.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to mano-coding@0.1.63.
The versions list below shows the verdict for each recorded version.
- Avoid installing mano-coding@0.1.63. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.