registry / mocode-ai / 0.6.6

mocode-ai@0.6.6

终端编码 agent:LLM + tool-call 循环 + 流式输出(含思考)+ 16 个工具,接任意 OpenAI 兼容后端。

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Running the `mocode` CLI enables an LLM-driven coding agent with shell, filesystem, and network capabilities. On startup, its self-updater may asynchronously install a newer global version of the same package.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the `mocode` binary; a cached newer version enables the update spawn.

Impact

The agent can act on the active project, and startup can replace the global package with a registry-provided newer release.

Mechanism

LLM tool execution plus detached package-owned global self-update.

Rationale

No concrete malicious chain was found, but the exposed agent powers and silent global self-update create a real dangerous-capability and supply-chain risk. Warn rather than block.

Evidence

package.jsonbin/mocode.jsdist/index.jsdist/updater/index.jsdist/tools/builtins/run-command.jsdist/tools/builtins/index.jsdist/pet/bridge.jsdist/config/file.js

Network endpoints3

registry.npmjs.org/api.anysearch.comws://127.0.0.1:<MOCODE_PET_PORT>

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/updater/index.js` auto-checks on CLI startup and can detach `npm install -g mocode-ai@latest`.
`dist/tools/builtins/run-command.js` exposes arbitrary shell execution to the coding agent.
`dist/tools/builtins/index.js` registers file-write, web, and command tools.

Evidence against

`package.json` has only a `prepare` build hook; no preinstall/install/postinstall hook.
The updater targets the package's own name and npm registry, not unrelated software or agent configuration.
No inspected source showed credential harvesting, hidden exfiltration, remote payload execution, or destructive install-time behavior.
`dist/pet/bridge.js` connects only to a loopback WebSocket and its optional pet process is user-invoked.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 108 file(s), 859 KB of source, external domains: api.anysearch.com, api.deepseek.com, api.minimax.io, dashscope.aliyuncs.com, open.bigmodel.cn, registry.npmjs.org

Source & flagged code

5 flagged

dist/ui/clipboard.jsView file

Lines 1-33javascript

1import { stdout, platform } from 'node:process';

2import { spawn } from 'node:child_process';

3/**

High

Child Process

Package source references child process execution.

dist/ui/clipboard.jsView on unpkg · L1

4 * 系统剪贴板读写(叶子模块,无 UI 依赖)。

5 *

6 * 写入(copyToClipboard):选区复制(layout 鼠标选择)与 /copy 等命令共用,双通道:

7 * 1. OSC 52(`\x1B]52;c;<base64>\x07`):请求终端把文本写入系统剪贴板。经终端转发,SSH / 远程也生效;

8 * Windows Terminal ≥1.16、iTerm2、kitty、WezTerm 等支持(部分终端默认关,需开"允许应用访问剪贴板")。

9 * 2. 本地原生工具(best-effort,失败静默):win32=clip.exe(UTF-16LE)、darwin=pbcopy、

10 * linux=wl-copy / xclip / xsel。覆盖 OSC52 被禁用的场景(如部分 VS Code 集成终端配置)。

11 * 两条都发:哪条生效由环境决定,重复写同一内容无副作用。

12 *

13 * 读取(readClipboard):OSC 52 是单向的(终端不会把剪贴板内容回传给应用,即便发 `\x1B]52;c;?\x07`

14 * 请求读取,多数终端出于安全考虑不响应),故读只能靠本地原生工具:win32=PowerShell Get-Clipboard、

15 * darwin=pbpaste、linux=wl-paste / xclip -o / xsel -o。供鼠标点击输入框时"贴入"用。

High

Shell

Package source references shell execution.

dist/ui/clipboard.jsView on unpkg · L13

16 */

17/** OSC 52:base64(UTF-8) 写系统剪贴板(c=clipboard 选区)。 */

18function osc52(text) {

19 const b64 = Buffer.from(text, 'utf8').toString('base64');

20 // 长度保护:部分终端对 OSC52 载荷有上限(常见 ~74KB / 100KB),超限直接跳过 OSC52

21 // (仍走原生通道),避免半截 base64 污染终端。

22 if (b64.length > 100000)

23 return;

24 stdout.write(`\x1B]52;c;${b64}\x07`);

25}

26/** spawn 一个吃 stdin 的剪贴板工具,把 buf 写入其 stdin;所有错误静默(best-effort)。 */

27function pipeTo(cmd, args, buf) {

28 try {

29 const p = spawn(cmd, args, {

30 stdio: ['pipe', 'ignore', 'ignore'],

31 windowsHide: true,

32 });

33 p.on('error', () => { }); // 命令不存在等:静默(OSC52 兜底)

dist/attachments/image.jsView file

Lines 38-78javascript

38 catch (e) {

39 const msg = e instanceof Error ? e.message : String(e);

40 return { ok: false, reason: `outside sandbox: ${msg}` };

41 }

42 let

dist/pet/bridge.jsView file

Lines 100-140javascript

100 settled = true;

101 clearTimeout(timer);

102 resolve(false);

103 });

104 });

105}

106/**

107 * 拉起独立 Electron 桌宠进程(detached,不随当前 mocode 进程退出而杀死)。

108 * 前置条件:调用方已确认端口未被占用(避免重复 spawn)。

109 * 后置条件:

dist/tools/builtins/run-command.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = mocode-ai@0.6.4 matchedIdentity = npm:bW9jb2RlLWFp:0.6.4 similarity = 0.932 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools/builtins/run-command.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/ui/clipboard.jsView file

1import { stdout, platform } from 'node:process'; L2: import { spawn } from 'node:child_process'; L3: /**

High

Child Process

Package source references child process execution.

dist/ui/clipboard.jsView on unpkg · L1

13* 读取(readClipboard):OSC 52 是单向的(终端不会把剪贴板内容回传给应用,即便发 `\x1B]52;c;?\x07` L14: * 请求读取,多数终端出于安全考虑不响应),故读只能靠本地原生工具:win32=PowerShell Get-Clipboard、 L15: * darwin=pbpaste、linux=wl-paste / xclip -o / xsel -o。供鼠标点击输入框时"贴入"用。

High

Shell

Package source references shell execution.

dist/ui/clipboard.jsView on unpkg · L13

dist/attachments/image.jsView file

58const buf = await readFile(abs); L59: const dataUrl = `data:${mime};base64,${buf.toString('base64')}`; L60: const id = createHash('sha1')

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/attachments/image.jsView on unpkg · L58

dist/pet/bridge.jsView file

120catch (e) { L121: reject(new Error('mocode-pet-app 未安装,请运行 npm install mocode-pet-app')); L122: return; ... L124: try { L125: const child = spawn(process.execPath, [binPath], { L126: detached: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/pet/bridge.jsView on unpkg · L120

dist/tools/builtins/run-command.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools/builtins/run-command.jsView on unpkg

Findings

1 Critical3 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/tools/builtins/run-command.js

HighChild Processdist/ui/clipboard.js

HighShelldist/ui/clipboard.js

HighRuntime Package Installdist/pet/bridge.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/attachments/image.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/ui/clipboard.jsView file

Lines 1-33javascript

1import { stdout, platform } from 'node:process';

2import { spawn } from 'node:child_process';

3/**

High

Child Process

Package source references child process execution.

dist/ui/clipboard.jsView on unpkg · L1

4 * 系统剪贴板读写(叶子模块,无 UI 依赖)。

5 *

6 * 写入(copyToClipboard):选区复制(layout 鼠标选择)与 /copy 等命令共用,双通道:

7 * 1. OSC 52(`\x1B]52;c;<base64>\x07`):请求终端把文本写入系统剪贴板。经终端转发,SSH / 远程也生效;

8 * Windows Terminal ≥1.16、iTerm2、kitty、WezTerm 等支持(部分终端默认关,需开"允许应用访问剪贴板")。

9 * 2. 本地原生工具(best-effort,失败静默):win32=clip.exe(UTF-16LE)、darwin=pbcopy、

10 * linux=wl-copy / xclip / xsel。覆盖 OSC52 被禁用的场景(如部分 VS Code 集成终端配置)。

11 * 两条都发:哪条生效由环境决定,重复写同一内容无副作用。

12 *

13 * 读取(readClipboard):OSC 52 是单向的(终端不会把剪贴板内容回传给应用,即便发 `\x1B]52;c;?\x07`

14 * 请求读取,多数终端出于安全考虑不响应),故读只能靠本地原生工具:win32=PowerShell Get-Clipboard、

15 * darwin=pbpaste、linux=wl-paste / xclip -o / xsel -o。供鼠标点击输入框时"贴入"用。

High

Shell

Package source references shell execution.

dist/ui/clipboard.jsView on unpkg · L13

16 */

17/** OSC 52:base64(UTF-8) 写系统剪贴板(c=clipboard 选区)。 */

18function osc52(text) {

19 const b64 = Buffer.from(text, 'utf8').toString('base64');

20 // 长度保护:部分终端对 OSC52 载荷有上限(常见 ~74KB / 100KB),超限直接跳过 OSC52

21 // (仍走原生通道),避免半截 base64 污染终端。

22 if (b64.length > 100000)

23 return;

24 stdout.write(`\x1B]52;c;${b64}\x07`);

25}

26/** spawn 一个吃 stdin 的剪贴板工具,把 buf 写入其 stdin;所有错误静默(best-effort)。 */

27function pipeTo(cmd, args, buf) {

28 try {

29 const p = spawn(cmd, args, {

30 stdio: ['pipe', 'ignore', 'ignore'],

31 windowsHide: true,

32 });

33 p.on('error', () => { }); // 命令不存在等:静默(OSC52 兜底)

dist/attachments/image.jsView file

Lines 38-78javascript

38 catch (e) {

39 const msg = e instanceof Error ? e.message : String(e);

40 return { ok: false, reason: `outside sandbox: ${msg}` };

41 }

42 let

dist/pet/bridge.jsView file

Lines 100-140javascript

100 settled = true;

101 clearTimeout(timer);

102 resolve(false);

103 });

104 });

105}

106/**

107 * 拉起独立 Electron 桌宠进程(detached,不随当前 mocode 进程退出而杀死)。

108 * 前置条件:调用方已确认端口未被占用(避免重复 spawn)。

109 * 后置条件:

dist/tools/builtins/run-command.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools/builtins/run-command.jsView on unpkg