spacecode@2.16.17

SpaceCode - launch cloud dev environments with AI coding agents

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The inspected credential path sends a supplied key to the agent process and uses SpaceCode’s own proxy when no key is supplied; it does not establish credential forwarding to an unrelated recipient. The package has no install hook, and the flagged `.claude` behavior is tied to explicit import functionality.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Running the CLI; agent import runs only when its import command is invoked.

Impact

No unauthorized credential transfer, install-time mutation, or agent control-surface change was established.

Mechanism

A supplied Anthropic key is placed in the agent environment. Otherwise, the CLI sets a proxy key and SpaceCode proxy URL. Import reads repository files, including Claude command files.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has CLI entrypoints and no install lifecycle script.
A caller-supplied Anthropic key is passed to the agent environment; without one, the CLI uses the SpaceCode proxy.
The flagged `.claude` references are used to read repository command files during an explicit agent import; another source scan skips `.claude`.
The MCP binary is a command-line entrypoint.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.60 MB of source, external domains: api.github.com, api.spacecode.app, app.spacecode.app, backend.spacecode.app, github.com, reactjs.org, sandbox.spacecode.app, us.i.posthog.com

Oversized source lightweight scan

dist/repl.mjs4.33 MB file, sampled 256 KB

Source & flagged code

12 flagged

dist/index.jsView file

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1122

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1122

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: baseUrl; constructor(baseUrl, token) { this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL; const url = `${this.baseUrl}${path6}`; headers["Authorization"] = `Bearer ${this.token}`; throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate"); const response = await fetch(`${this.baseUrl}/health`, { const url = `${this.baseUrl}/api/auth/exchange`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

253BackendApiClient = class { L254: baseUrl; L255: token; ... L1122: try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {}; ... L7689: if (stat2.size > 256 * 1024) continue; L7690: const content = fs.readFileSync(absPath, "utf-8"); L7691: this.options.send({ type: "file_sync", path: filePath, content });

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L253

38Cross-file remote execution chain: dist/index.js spawns dist/mcp/index.js; helper contains network access plus dynamic code execution. L38: function initPostHog() { L39: apiKey = process.env.POSTHOG_API_KEY || void 0; L40: host = (process.env.POSTHOG_HOST || host).replace(/\/+$/, ""); ... L46: if (!apiKey) return; L47: fetch(`${host}/capture/`, { L48: method: "POST", L49: headers: { "Content-Type": "application/json" }, L50: body: JSON.stringify({ L51: api_key: apiKey, ... L316: if (response.status === 429) { L317: const errorData = await response.json().catch(() => ({})); L318: const retryAfter = errorData.retryAfter ? new Date(errorData.retryAfter) : new Date(Date.now() + 12e4);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L38

•matchType = normalized_sha256 matchedPackage = spacecode@2.0.2 matchedPath = dist/index.js matchedIdentity = npm:c3BhY2Vjb2Rl:2.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 892f9b166dcf3981 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = spacecode@2.0.2 matchedPath = dist/index.js matchedIdentity = npm:c3BhY2Vjb2Rl:2.0.2 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

38function initPostHog() { L39: apiKey = process.env.POSTHOG_API_KEY || void 0; L40: host = (process.env.POSTHOG_HOST || host).replace(/\/+$/, ""); ... L46: if (!apiKey) return; L47: fetch(`${host}/capture/`, { L48: method: "POST", L49: headers: { "Content-Type": "application/json" }, L50: body: JSON.stringify({ L51: api_key: apiKey, ... L316: if (response.status === 429) { L317: const errorData = await response.json().catch(() => ({})); L318: const retryAfter = errorData.retryAfter ? new Date(errorData.retryAfter) : new Date(Date.now() + 12e4);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L38

dist/repl.mjsView file

•matchType = normalized_sha256 matchedPackage = spacecode@2.0.2 matchedPath = dist/repl.mjs matchedIdentity = npm:c3BhY2Vjb2Rl:2.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/repl.mjsView on unpkg

•path = dist/repl.mjs kind = oversized_source_file sizeBytes = 4538610 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/repl.mjsView on unpkg

•path = dist/repl.mjs kind = oversized_cli_entrypoint sizeBytes = 4538610 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/repl.mjsView on unpkg

dist/mcp/index.jsView file

•matchType = normalized_sha256 matchedPackage = spacecode@2.0.2 matchedPath = dist/mcp/index.js matchedIdentity = npm:c3BhY2Vjb2Rl:2.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/index.jsView on unpkg

Source & flagged code

12 flagged · loading source

dist/index.jsView file

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1122

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1122

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.js

Findings

9 High5 Medium4 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCredential Redirect Persistencedist/index.js

HighRemote Agent Bridgedist/index.js

HighCross File Remote Execution Contextdist/index.js

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Similaritydist/mcp/index.js

HighKnown Malware Source Similaritydist/repl.mjs

HighKnown Malware Source Fingerprint Signaturedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/repl.mjs

MediumOversized Cli Entrypointdist/repl.mjs

Affected versions and remediation

This report applies to spacecode@2.16.17.

See all versions of spacecode for other recorded verdicts.

Review the evidence and your use of spacecode@2.16.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 02:04:50.620Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.