spacecode@2.16.69

SpaceCode - launch cloud dev environments with AI coding agents

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The flagged credential redirection is not supported by the inspected source: the default endpoint is the package’s SpaceCode proxy, while custom keys and the option to bypass that proxy are user-selected. The manifest has no install hook, and reviewed source showed no concrete attack behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A user runs the CLI or explicitly signs in with a SpaceCode API key.

Impact

The reviewed behavior supports the package’s cloud development and authentication features; no unconsented credential transfer or malicious persistence was established.

Mechanism

The CLI selects the SpaceCode proxy unless the user supplies a custom key or selects the own-key option; its login flow saves a validated SpaceCode key.

AI rationale

Evidence

package.jsondist/index.jsdist/mcp/index.jsdist/repl.mjs.lpm-dependency-evidence-014f1d9e-8c34-4582-9acd-243e9e3fec84/0/npm-linux/package.json.lpm-dependency-evidence-014f1d9e-8c34-4582-9acd-243e9e3fec84/1/npm-linux/package.json.lpm-dependency-evidence-014f1d9e-8c34-4582-9acd-243e9e3fec84/1/npm-linux/source/index.js.lpm-dependency-evidence-014f1d9e-8c34-4582-9acd-243e9e3fec84/2/npm-linux/package.json.lpm-dependency-evidence-014f1d9e-8c34-4582-9acd-243e9e3fec84/2/npm-linux/esm.mjs.lpm-dependency-evidence-014f1d9e-8c34-4582-9acd-243e9e3fec84/2/npm-linux/index.js

Network endpoints3

api.spacecode.appbackend.spacecode.appapp.spacecode.app

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes command-line entry points and ordinary library dependencies, with no install lifecycle script.
The CLI uses the SpaceCode proxy by default; a supplied custom API key is passed to the agent process, and the own-key option skips the proxy.
Saved API keys are validated as SpaceCode keys and stored through the package’s authentication flow.
Inspected dependency sources show normal library entry points and no install hooks in the reviewed manifests.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.60 MB of source, external domains: api.github.com, api.spacecode.app, app.spacecode.app, backend.spacecode.app, github.com, reactjs.org, sandbox.spacecode.app, us.i.posthog.com

Oversized source lightweight scan

Source & flagged code

12 flagged

dist/index.jsView file

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1122

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1122

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: baseUrl; constructor(baseUrl, token) { this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL; const url = `${this.baseUrl}${path6}`; headers["Authorization"] = `Bearer ${this.token}`; throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate"); const response = await fetch(`${this.baseUrl}/health`, { const url = `${this.baseUrl}/api/auth/exchange`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

253BackendApiClient = class { L254: baseUrl; L255: token; ... L1122: try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {}; ... L7689: if (stat2.size > 256 * 1024) continue; L7690: const content = fs.readFileSync(absPath, "utf-8"); L7691: this.options.send({ type: "file_sync", path: filePath, content });

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L253

38Cross-file remote execution chain: dist/index.js spawns dist/mcp/index.js; helper contains network access plus dynamic code execution. L38: function initPostHog() { L39: apiKey = process.env.POSTHOG_API_KEY || void 0; L40: host = (process.env.POSTHOG_HOST || host).replace(/\/+$/, ""); ... L46: if (!apiKey) return; L47: fetch(`${host}/capture/`, { L48: method: "POST", L49: headers: { "Content-Type": "application/json" }, L50: body: JSON.stringify({ L51: api_key: apiKey, ... L316: if (response.status === 429) { L317: const errorData = await response.json().catch(() => ({})); L318: const retryAfter = errorData.retryAfter ? new Date(errorData.retryAfter) : new Date(Date.now() + 12e4);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L38

•matchType = normalized_sha256 matchedPackage = spacecode@2.16.65 matchedPath = dist/index.js matchedIdentity = npm:c3BhY2Vjb2Rl:2.16.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 892f9b166dcf3981 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = spacecode@2.16.65 matchedPath = dist/index.js matchedIdentity = npm:c3BhY2Vjb2Rl:2.16.65 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

38function initPostHog() { L39: apiKey = process.env.POSTHOG_API_KEY || void 0; L40: host = (process.env.POSTHOG_HOST || host).replace(/\/+$/, ""); ... L46: if (!apiKey) return; L47: fetch(`${host}/capture/`, { L48: method: "POST", L49: headers: { "Content-Type": "application/json" }, L50: body: JSON.stringify({ L51: api_key: apiKey, ... L316: if (response.status === 429) { L317: const errorData = await response.json().catch(() => ({})); L318: const retryAfter = errorData.retryAfter ? new Date(errorData.retryAfter) : new Date(Date.now() + 12e4);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L38

dist/repl.mjsView file

•matchType = normalized_sha256 matchedPackage = spacecode@2.16.65 matchedPath = dist/repl.mjs matchedIdentity = npm:c3BhY2Vjb2Rl:2.16.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/repl.mjsView on unpkg

•path = dist/repl.mjs kind = oversized_source_file sizeBytes = 4584333 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/repl.mjsView on unpkg

•path = dist/repl.mjs kind = oversized_cli_entrypoint sizeBytes = 4584333 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/repl.mjsView on unpkg

dist/mcp/index.jsView file

•matchType = normalized_sha256 matchedPackage = spacecode@2.16.65 matchedPath = dist/mcp/index.js matchedIdentity = npm:c3BhY2Vjb2Rl:2.16.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/index.jsView on unpkg

Source & flagged code

12 flagged · loading source

dist/index.jsView file

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1122

1122try { L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec); L1124: const options = {};

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1122

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.js

Findings

9 High5 Medium4 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCredential Redirect Persistencedist/index.js

HighRemote Agent Bridgedist/index.js

HighCross File Remote Execution Contextdist/index.js

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Similaritydist/mcp/index.js

HighKnown Malware Source Similaritydist/repl.mjs

HighKnown Malware Source Fingerprint Signaturedist/index.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/repl.mjs

MediumOversized Cli Entrypointdist/repl.mjs

Affected versions and remediation

This report applies to spacecode@2.16.69.

See all versions of spacecode for other recorded verdicts.

Review the evidence and your use of spacecode@2.16.69 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 21:04:42.881Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.