orlithra-coding-agent@0.0.30
Secure coding agent CLI with session management
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe runtime forwards a saved service token to an unrestricted environment-configured proxy, creating conditional credential exposure. The manifest has no install hook, so the appropriate action is a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Run an agent request using the Orlithra gateway while ORLITHRA_API_URL points to a custom endpoint.
Impact
The configured recipient can receive the service token.
Mechanism
The runtime passes the saved access token to the proxy and sends it as a bearer credential, without validating the recipient host.
AI rationale
The runtime forwards a saved service token to an unrestricted environment-configured proxy, creating conditional credential exposure. The manifest has no install hook, so the appropriate action is a warning rather than a publish block.
Evidence
dist/bundle/chunk-TN3437EK.jsdist/bundle/chunk-KRTTFD5Z.jspackage.json
Network endpoints1
api.orlithra.com
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI entry point has a prepublish-only build script, with no install lifecycle hook.
- Gateway model authentication retrieves the saved Orlithra CLI access token and requires a login.
- The active agent path passes that token to the proxy, whose URL accepts ORLITHRA_API_URL without a host allowlist.
- Proxy invocation requests send the token as a bearer credential.
Evidence against
- Exposure requires a gateway model request and a configured ORLITHRA_API_URL; the default endpoint is the Orlithra service.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
10 flagged · loading sourcedist/bundle/chunk-TN3437EK.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = orlithra-coding-agent@0.0.9
matchedIdentity = npm:b3JsaXRocmEtY29kaW5nLWFnZW50:0.0.9
similarity = 0.733
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bundle/chunk-TN3437EK.jsView on unpkg2588// dist/package-manager-cli.js
L2589: import { spawn as spawn3 } from "child_process";
L2590: import { readFileSync as readFileSync5, rmSync as rmSync4, statSync as statSync2 } from "fs";
High
Child Process
Package source references child process execution.
dist/bundle/chunk-TN3437EK.jsView on unpkg · L258814802const daemonArgs = [
L14803: ...process.execArgv,
L14804: entrypoint,
High
Findings
1 Critical8 High4 Medium8 Low
CriticalPrevious Version Dangerous Deltadist/bundle/chunk-TN3437EK.js
HighChild Processdist/bundle/chunk-TN3437EK.js
HighShelldist/bundle/chunk-TN3437EK.js
HighSame File Env Network Executiondist/bundle/chunk-TN3437EK.js
HighCredential Redirect Persistencedist/bundle/chunk-KRTTFD5Z.js
HighRemote Agent Bridgedist/bundle/chunk-TN3437EK.js
HighCross File Remote Execution Contextdist/bundle/chunk-KRTTFD5Z.js
HighSemantic Analysis Limiteddist/bundle/chunk-TN3437EK.js
HighKnown Malware Source Similaritydist/core/export-html/vendor/highlight.min.js
MediumDynamic Requiredist/bundle/jiti-static-CY6V476M.js
Medium
Affected versions and remediation
This report applies to orlithra-coding-agent@0.0.30.
See all versions of orlithra-coding-agent for other recorded verdicts.
- Review the evidence and your use of orlithra-coding-agent@0.0.30 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.