registry / Credential exfiltration / solvit-cli
solvit-cli
Solve or fix a coding file from your terminal using any OpenAI-compatible LLM endpoint.
This report shows the evidence for solvit-cli@0.4.3. 1 of 7 known versions is blocked or flagged. The newest version, 0.5.0, is flagged. See all versions.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe built-in fallback contradicts its own comment by forwarding SOLVIT_API_KEY to a fixed package-selected endpoint when no base URL is configured. This is concrete credential disclosure, so blocking publication is warranted.
Static reason
One or more suspicious static signals were detected.
Trigger
Running a command that makes a model request while SOLVIT_API_KEY is set and no base URL is configured.
Impact
A user-held API key can be disclosed to the package-selected endpoint along with the request content.
Mechanism
The default configuration selects the bundled endpoint but still prefers SOLVIT_API_KEY; the request attaches the chosen key as a Bearer credential.
Attack narrative
With no configured base URL, the launcher chooses the bundled endpoint. Its default branch nevertheless prefers SOLVIT_API_KEY over the bundled key, then sends that value in the request's Authorization header. This exposes a user-held key to the package-selected endpoint without recipient-specific consent.
AI rationale
The built-in fallback contradicts its own comment by forwarding SOLVIT_API_KEY to a fixed package-selected endpoint when no base URL is configured. This is concrete credential disclosure, so blocking publication is warranted.
Evidence
bin/solvit.jsbin/defaults.js
Network endpoints1
144.24.117.169:20128
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- When no endpoint is configured, the launcher selects a built-in endpoint and uses SOLVIT_API_KEY ahead of the bundled key.
- The built-in endpoint and bundled API key are fixed in package source.
- The request sends the selected API key as a Bearer credential with the prompt messages.
- The CLI exposes solve and chat operations that invoke the request flow.
Evidence against
- Users can configure a base URL, and the package describes itself as an OpenAI-compatible coding tool.
- The chat client sends its saved token to the selected chat server and saves the token with restrictive file permissions.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedbin/chat.jsView file
32function chatUrl(session, builtin) {
let url = process.env.SOLVIT_CHAT_URL || session.url || builtin.chatUrl || '';
if (!url && builtin.baseUrl) {
try { url = `${new URL(builtin.baseUrl).protocol}//${new URL(builtin.baseUrl).hostname}:${CHAT_PORT}`; } catch { /* bad URL */ }
}
return url.replace(/\/+$/, '');
}
High
Ai Review Evidence
The CLI exposes solve and chat operations that invoke the request flow.
bin/chat.jsView on unpkg · L32104patternName = generic_password
severity = medium
line = 104
Medium
bin/solvit.jsView file
82if (!baseUrl && BUILTIN.baseUrl) {
// The built-in URL pairs only with the built-in key, never with a key the user set for another service.
return { baseUrl: BUILTIN.baseUrl, apiKey: e.SOLVIT_API_KEY || BUILTIN.apiKey || '', model, builtin: true };
}
const apiKey = e.SOLVIT_API_KEY ||
High
Findings
6 High3 Medium3 Low
HighAi Review Evidencebin/solvit.js
HighAi Review Evidencebin/defaults.js
HighAi Review Evidencebin/solvit.js
HighAi Review Evidencebin/solvit.js
HighAi Review Evidencebin/solvit.js
HighAi Review Evidencebin/chat.js
MediumSecret Patternbin/chat.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to solvit-cli@0.4.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing solvit-cli@0.4.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.