registry / orlithra-coding-agent / 0.0.27

orlithra-coding-agent@0.0.27

⚠ Under review

Secure coding agent CLI with session management

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The inspected credential code sends login requests to the configured Orlithra API base and retains that base with the credentials; it does not establish covert forwarding. The selected playwright-core dependency is unresolved and imported for browser tools, so its behavior cannot be cleared from this source snapshot.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Using the package's browser tools can activate the imported browser dependency.

Impact

The browser dependency's behavior remains uncertain; the inspected sources do not establish an attack.

Mechanism

The bundle imports playwright-core for browser operations, but its source was unavailable for inspection.

AI rationale

Evidence

package.jsondist/bundle/chunk-WGR6PEGT.js

Decision evidence

public snapshot

AI called this Manual Review at 88.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json declares playwright-core, and the bundle imports it for browser tools.
The inspected credential flow selects the Orlithra API base URL, sends login requests there, and stores that base URL with the returned credentials.
The package manifest points its executable to the CLI bundle; the shown prepublishOnly script runs clean and build.

Evidence against

The inspected credential flow does not establish an unrelated recipient or covert credential transfer.
The unresolved playwright-core dependency source prevents resolving all behavior on this imported runtime path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Source & flagged code

10 flagged

dist/bundle/chunk-WGR6PEGT.jsView file

11838// dist/config.js L11839: import { spawnSync } from "child_process"; L11840: import { createHash } from "crypto";

High

Child Process

Package source references child process execution.

dist/bundle/chunk-WGR6PEGT.jsView on unpkg · L11838

12414try { L12415: return query("powershell.exe", [ L12416: "-NoLogo",

High

Shell

Package source references shell execution.

dist/bundle/chunk-WGR6PEGT.jsView on unpkg · L12414

35121import { createRequire as createRequire2 } from "node:module"; L35122: import { execFile } from "node:child_process"; L35123: import { chmodSync as chmodSync4, closeSync as closeSync4, existsSync as existsSync9, mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync10, renameSync as ... ... L35126: import { randomUUID as randomUUID7 } from "node:crypto"; L35127: var DEFAULT_API_URL = "https://api.orlithra.com"; L35128: var ACCESS_REFRESH_SKEW_MS = 6e4; ... L35132: function optionalKeyring() { L35133: if (process.env.ORLITHRA_DISABLE_KEYRING === "1") L35134: return void 0;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundle/chunk-WGR6PEGT.jsView on unpkg · L35121

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bundle/chunk-WGR6PEGT.js: var fs$writeFile = fs6.writeFile; fs6.writeFile = writeFile2; function writeFile2(path6, data, options2, cb) { return go$writeFile(path6, data, options2, cb); function go$writeFile(path7, data2, options3, cb2, startTime) { return fs$writeFile(path7, data2, options3, function(err) { enqueue([go$writeFile, [path7, data2, options3, cb2], err, startTime || Date.now(), Date.now()]); const baseUrl = process.env.ORLITHRA_CODE_SHARE_VIEWER_URL || DEFAULT_SHARE_VIEWER_URL;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bundle/chunk-WGR6PEGT.jsView on unpkg

11838// dist/config.js L11839: import { spawnSync } from "child_process"; L11840: import { createHash } from "crypto"; ... L12226: } L12227: var pkg = JSON.parse(readFileSync(getPackageJsonPath(), "utf-8")); L12228: var piConfigName = pkg.piConfig?.name; ... L12246: function getShareViewerUrl(gistId) { L12247: const baseUrl = process.env.ORLITHRA_CODE_SHARE_VIEWER_URL || DEFAULT_SHARE_VIEWER_URL; L12248: return `${baseUrl}#${gistId}`;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bundle/chunk-WGR6PEGT.jsView on unpkg · L11838

dist/bundle/chunk-HA2I4VYO.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = orlithra-coding-agent@0.0.9 matchedIdentity = npm:b3JsaXRocmEtY29kaW5nLWFnZW50:0.0.9 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bundle/chunk-HA2I4VYO.jsView on unpkg

564Cross-file remote execution chain: dist/bundle/chunk-HA2I4VYO.js spawns dist/bundle/chunk-WGR6PEGT.js; helper contains network access plus dynamic code execution. L564: if (offset < entireSlice.length) { L565: readStream.write(entireSlice.slice(offset, entireSlice.length)); L566: } ... L1328: var destroyed = false; L1329: var inflateFilter = zlib.createInflateRaw(); L1330: readStream.on("error", function(err) { ... L1734: provider: "orlithra-gateway", L1735: baseUrl: "https://api.orlithra.com", L1736: reasoning: false, ... L2099: return new Promise((resolve19) => { L2100: const rl = createInterface({ input: process.stdin, output: process.stdout }); L2101: rl.question(`${message} [y/N] `, (answer) => {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundle/chunk-HA2I4VYO.jsView on unpkg · L564

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

dist/core/export-html/vendor/highlight.min.jsView file

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = core/dist/core/export-html/vendor/highlight.min.js matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/export-html/vendor/highlight.min.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/bundle/chunk-WGR6PEGT.jsView file

11838// dist/config.js L11839: import { spawnSync } from "child_process"; L11840: import { createHash } from "crypto";

High

Child Process

Package source references child process execution.

dist/bundle/chunk-WGR6PEGT.jsView on unpkg · L11838

12414try { L12415: return query("powershell.exe", [ L12416: "-NoLogo",

High

Shell

Package source references shell execution.

dist/bundle/chunk-WGR6PEGT.jsView on unpkg · L12414

High

Same File Env Network Execution

Findings

1 Critical8 High4 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/bundle/chunk-HA2I4VYO.js

HighChild Processdist/bundle/chunk-WGR6PEGT.js

HighShelldist/bundle/chunk-WGR6PEGT.js

HighSame File Env Network Executiondist/bundle/chunk-WGR6PEGT.js

HighCredential Redirect Persistencedist/bundle/chunk-WGR6PEGT.js

HighRemote Agent Bridgedist/bundle/chunk-WGR6PEGT.js

HighCross File Remote Execution Contextdist/bundle/chunk-HA2I4VYO.js

HighSemantic Analysis Limiteddist/bundle/chunk-HA2I4VYO.js

HighKnown Malware Source Similaritydist/core/export-html/vendor/highlight.min.js

MediumDynamic Requiredist/bundle/chunk-HA2I4VYO.js

Medium

Affected versions and remediation

This report applies to orlithra-coding-agent@0.0.27.

See all versions of orlithra-coding-agent for other recorded verdicts.

Review the evidence and your use of orlithra-coding-agent@0.0.27 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 08:32:50.436Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.