registry / Credential exfiltration / orlithra-coding-agent / 0.0.33

orlithra-coding-agent@0.0.33

Secure coding agent CLI with session management

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The runtime forwards a model API key to a configurable gateway, creating conditional credential exposure if the destination is unintended. The inspected source does not establish a hidden transfer or a malicious default recipient, so this warrants a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A caller invokes a model stream with an API key.

Impact

The configured gateway receives the supplied credential; an unintended endpoint could expose it to that endpoint's operator.

Mechanism

The stream passes that key as a bearer token to the gateway URL, which may come from ORLITHRA_API_URL.

AI rationale

Evidence

dist/bundle/chunk-AURRRJLW.jsdist/bundle/cli.js

Network endpoints1

api.orlithra.com

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI entrypoint loads the packaged runtime.
The model stream passes its API key as a bearer token to a gateway whose URL can be set through an environment variable, defaulting to api.orlithra.com.
The gateway request sends that bearer token in an Authorization header.

Evidence against

The manifest shows a prepublishOnly build hook, not an install-time hook.
The inspected source establishes conditional credential forwarding but does not establish that the default gateway is malicious or that forwarding is hidden.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

Source & flagged code

10 flagged

dist/bundle/chunk-RGQHZUTR.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = orlithra-coding-agent@0.0.9 matchedIdentity = npm:b3JsaXRocmEtY29kaW5nLWFnZW50:0.0.9 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bundle/chunk-RGQHZUTR.jsView on unpkg

2588// dist/package-manager-cli.js L2589: import { spawn as spawn3 } from "child_process"; L2590: import { readFileSync as readFileSync5, rmSync as rmSync4, statSync as statSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/bundle/chunk-RGQHZUTR.jsView on unpkg · L2588

14802const daemonArgs = [ L14803: ...process.execArgv, L14804: entrypoint,

High

Shell

Package source references shell execution.

dist/bundle/chunk-RGQHZUTR.jsView on unpkg · L14802

43806var import_yauzl = __toESM(require_yauzl(), 1); L43807: import { spawnSync as spawnSync4 } from "child_process"; L43808: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync13, mkdirSync as mkdirSync9, readdirSync as readdirSync6, renameSync as renameSync5, rmSync as rmSync7 ... ... L43818: var MAX_BINARY_BYTES = 128 * 1024 * 1024; L43819: var RIPGREP_INSTALL_URL = "https://github.com/BurntSushi/ripgrep#installation"; L43820: function isOfflineModeEnabled2() { L43821: const value = process.env.ORLITHRA_CODE_OFFLINE; L43822: if (!value)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bundle/chunk-RGQHZUTR.jsView on unpkg · L43806

321[redacted], L322: [redacted], L323: resolveReadPath, ... L2311: try { L2312: return originalReadFileSync(...args); L2313: } catch (error51) { ... L2588: // dist/package-manager-cli.js L2589: import { spawn as spawn3 } from "child_process"; L2590: import { readFileSync as readFileSync5, rmSync as rmSync4, statSync as statSync2 } from "fs";

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bundle/chunk-RGQHZUTR.jsView on unpkg · L321

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bundle/chunk-RGQHZUTR.jsView on unpkg

1import { createRequire as __piBundleCreateRequire } from 'node:module'; const require = __piBundleCreateRequire(import.meta.url); L2: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bundle/chunk-RGQHZUTR.jsView on unpkg · L1

dist/bundle/chunk-AURRRJLW.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bundle/chunk-AURRRJLW.js: var fs$writeFile = fs6.writeFile; fs6.writeFile = writeFile2; function writeFile2(path6, data, options2, cb) { return go$writeFile(path6, data, options2, cb); function go$writeFile(path7, data2, options3, cb2, startTime) { return fs$writeFile(path7, data2, options3, function(err) { enqueue([go$writeFile, [path7, data2, options3, cb2], err, startTime || Date.now(), Date.now()]); const baseUrl = process.env.ORLITHRA_CODE_SHARE_VIEWER_URL || DEFAULT_SHARE_VIEWER_URL;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bundle/chunk-AURRRJLW.jsView on unpkg

313Cross-file remote execution chain: dist/bundle/chunk-AURRRJLW.js spawns dist/bundle/chunk-IRMZ2I7B.js; helper contains network access plus dynamic code execution. L313: var cwd = null; L314: var platform2 = process.env.GRACEFUL_FS_PLATFORM || process.platform; L315: process.cwd = function() { ... L320: try { L321: process.cwd(); L322: } catch (er) { ... L1091: } L1092: this._originalTimeouts = JSON.parse(JSON.stringify(timeouts)); L1093: this._timeouts = timeouts; ... L1466: } L1467: process3.exitCode = code || /* istanbul ignore next */ L1468: 0;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bundle/chunk-AURRRJLW.jsView on unpkg · L313

dist/core/export-html/vendor/highlight.min.jsView file

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = core/dist/core/export-html/vendor/highlight.min.js matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/export-html/vendor/highlight.min.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/bundle/chunk-RGQHZUTR.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bundle/chunk-RGQHZUTR.jsView on unpkg

2588// dist/package-manager-cli.js L2589: import { spawn as spawn3 } from "child_process"; L2590: import { readFileSync as readFileSync5, rmSync as rmSync4, statSync as statSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/bundle/chunk-RGQHZUTR.jsView on unpkg · L2588

14802const daemonArgs = [ L14803: ...process.execArgv, L14804: entrypoint,

High

Shell

Package source references shell execution.

dist/bundle/chunk-RGQHZUTR.jsView on unpkg · L14802

Findings

1 Critical8 High4 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/bundle/chunk-RGQHZUTR.js

HighChild Processdist/bundle/chunk-RGQHZUTR.js

HighShelldist/bundle/chunk-RGQHZUTR.js

HighSame File Env Network Executiondist/bundle/chunk-RGQHZUTR.js

HighCredential Redirect Persistencedist/bundle/chunk-AURRRJLW.js

HighRemote Agent Bridgedist/bundle/chunk-RGQHZUTR.js

HighCross File Remote Execution Contextdist/bundle/chunk-AURRRJLW.js

HighSemantic Analysis Limiteddist/bundle/chunk-RGQHZUTR.js

HighKnown Malware Source Similaritydist/core/export-html/vendor/highlight.min.js

MediumDynamic Requiredist/bundle/chunk-RGQHZUTR.js

Medium

Affected versions and remediation

This report applies to orlithra-coding-agent@0.0.33.

See all versions of orlithra-coding-agent for other recorded verdicts.

Review the evidence and your use of orlithra-coding-agent@0.0.33 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 08:34:12.905Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code