registry / Credential exfiltration / spacecode / 2.16.57

spacecode@2.16.57

SpaceCode - launch cloud dev environments with AI coding agents

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The default sandbox host is SpaceCode’s service, but both binaries forward the saved account token to any host selected through `SANDBOX_WORKER_URL`. This is a conditional credential exposure risk, not evidence of a package-selected unrelated recipient or covert installation transfer.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A user runs CLI or MCP sandbox operations with `SANDBOX_WORKER_URL` set to an alternate host.

Impact

An alternate recipient can obtain the SpaceCode account token. The default destination is `https://sandbox.spacecode.app`.

Mechanism

The clients use the environment-selected URL and attach the resolved token as a Bearer credential; source shows no destination allowlist.

AI rationale

Evidence

dist/index.jsdist/mcp/index.js

Network endpoints1

sandbox.spacecode.app

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI and MCP server can use a saved SpaceCode access token or one supplied through the environment.
Both builds use `SANDBOX_WORKER_URL` when set, with `https://sandbox.spacecode.app` as the default.
Their sandbox operations pass the resolved token into clients using that selected URL.
Those clients send the token as a Bearer credential in requests to the selected host.

Evidence against

The default sandbox destination is the SpaceCode host; an alternate destination requires the operator to set an environment variable.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.60 MB of source, external domains: api.github.com, api.spacecode.app, app.spacecode.app, backend.spacecode.app, github.com, reactjs.org, sandbox.spacecode.app, us.i.posthog.com

Source & flagged code

12 flagged

dist/index.jsView file

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1122

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1122

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: baseUrl; constructor(baseUrl, token) { this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL; const url = `${this.baseUrl}${path6}`; headers["Authorization"] = `Bearer ${this.token}`; throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate"); const response = await fetch(`${this.baseUrl}/health`, { const url = `${this.baseUrl}/api/auth/exchange`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

253BackendApiClient = class { L254: baseUrl; L255: token; ... L1122: try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {}; ... L7689: if (stat2.size > 256 * 1024) continue; L7690: const content = fs.readFileSync(absPath, "utf-8"); L7691: this.options.send({ type: "file_sync", path: filePath, content });

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L253

38Cross-file remote execution chain: dist/index.js spawns dist/mcp/index.js; helper contains network access plus dynamic code execution. L38: function initPostHog() { L39: apiKey = process.env.POSTHOG_API_KEY || void 0; L40: host = (process.env.POSTHOG_HOST || host).replace(/\/+$/, ""); ... L46: if (!apiKey) return; L47: fetch(`${host}/capture/`, { L48: method: "POST", L49: headers: { "Content-Type": "application/json" }, L50: body: JSON.stringify({ L51: api_key: apiKey, ... L316: if (response.status === 429) { L317: const errorData = await response.json().catch(() => ({})); L318: const retryAfter = errorData.retryAfter ? new Date(errorData.retryAfter) : new Date(Date.now() + 12e4);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L38

•matchType = normalized_sha256 matchedPackage = spacecode@2.16.26 matchedPath = dist/index.js matchedIdentity = npm:c3BhY2Vjb2Rl:2.16.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 892f9b166dcf3981 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = spacecode@2.16.26 matchedPath = dist/index.js matchedIdentity = npm:c3BhY2Vjb2Rl:2.16.26 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

38function initPostHog() { L39: apiKey = process.env.POSTHOG_API_KEY || void 0; L40: host = (process.env.POSTHOG_HOST || host).replace(/\/+$/, ""); ... L46: if (!apiKey) return; L47: fetch(`${host}/capture/`, { L48: method: "POST", L49: headers: { "Content-Type": "application/json" }, L50: body: JSON.stringify({ L51: api_key: apiKey, ... L316: if (response.status === 429) { L317: const errorData = await response.json().catch(() => ({})); L318: const retryAfter = errorData.retryAfter ? new Date(errorData.retryAfter) : new Date(Date.now() + 12e4);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L38

dist/repl.mjsView file

•matchType = normalized_sha256 matchedPackage = spacecode@2.16.26 matchedPath = dist/repl.mjs matchedIdentity = npm:c3BhY2Vjb2Rl:2.16.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/repl.mjsView on unpkg

•path = dist/repl.mjs kind = oversized_source_file sizeBytes = 4569066 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/repl.mjsView on unpkg

•path = dist/repl.mjs kind = oversized_cli_entrypoint sizeBytes = 4569066 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/repl.mjsView on unpkg

dist/mcp/index.jsView file

•matchType = normalized_sha256 matchedPackage = spacecode@2.16.26 matchedPath = dist/mcp/index.js matchedIdentity = npm:c3BhY2Vjb2Rl:2.16.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/index.jsView on unpkg

Source & flagged code

12 flagged · loading source

dist/index.jsView file

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1122

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1122

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.js

Findings

9 High5 Medium4 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCredential Redirect Persistencedist/index.js

HighRemote Agent Bridgedist/index.js

HighCross File Remote Execution Contextdist/index.js

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Similaritydist/mcp/index.js

HighKnown Malware Source Similaritydist/repl.mjs

HighKnown Malware Source Fingerprint Signaturedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/repl.mjs

MediumOversized Cli Entrypointdist/repl.mjs

Affected versions and remediation

This report applies to spacecode@2.16.57.

See all versions of spacecode for other recorded verdicts.

Review the evidence and your use of spacecode@2.16.57 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 05:49:16.615Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.