spacecode@2.16.65
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe REPL forwards an existing Anthropic credential to a package-selected gateway without recipient-specific consent. The gateway’s product alignment does not establish that the user authorized exporting credentials intended for Anthropic.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user submits a prompt in the bundled local REPL while an Anthropic API key is available in the environment.
Impact
The gateway receives the Anthropic credential, allowing exposure beyond its intended service.
Mechanism
The REPL resolves that key and includes it in the request to its default gateway, without a recipient-specific confirmation.
Attack narrative
When a user submits a prompt, the REPL can resolve ANTHROPIC_API_KEY and send it as the authentication key for a request to the default SpaceCode gateway. The source shows no recipient-specific confirmation for forwarding that existing Anthropic credential.
AI rationale
The REPL forwards an existing Anthropic credential to a package-selected gateway without recipient-specific consent. The gateway’s product alignment does not establish that the user authorized exporting credentials intended for Anthropic.
Evidence
package.jsondist/repl.mjs
Network endpoints1
api.spacecode.app
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- The shipped REPL accepts an existing Anthropic API key or saved authentication token as its API key.
- After a prompt, the REPL uses the package’s default SpaceCode gateway and sends the key in an authenticated model request.
- The package manifest includes the REPL bundle in its distributed files.
Evidence against
- The gateway belongs to the SpaceCode service, and the source presents it as the REPL’s model gateway.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
dist/repl.mjs
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.16.65.
See all versions of spacecode for other recorded verdicts.
- Avoid installing spacecode@2.16.65. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.