spacecode@2.16.72
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe default local REPL path forwards an existing credential for Anthropic’s service to a package-selected gateway. This is concrete credential disclosure and supports blocking publication.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Running the CLI without a target starts the local REPL when an Anthropic API key is available in the environment.
Impact
The gateway receives the Anthropic credential and the associated agent request data.
Mechanism
The REPL selects ANTHROPIC_API_KEY as a fallback, then includes the selected key in requests to the default SpaceCode gateway without a recipient-specific consent check.
Attack narrative
When the CLI starts its local REPL, it reads ANTHROPIC_API_KEY if no SpaceCode API key is set. It then sends requests with that key to api.spacecode.app by default. The source shows no recipient-specific consent gate for forwarding the Anthropic credential.
AI rationale
The default local REPL path forwards an existing credential for Anthropic’s service to a package-selected gateway. This is concrete credential disclosure and supports blocking publication.
Evidence
package.jsondist/index.jsdist/repl.mjs
Network endpoints1
api.spacecode.app
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes the CLI, whose no-target invocation starts the local REPL.
- The REPL accepts an existing ANTHROPIC_API_KEY as a fallback and returns it as the API key.
- The REPL uses https://api.spacecode.app by default and sends its selected key in request headers; API_PROXY_URL is only an override.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
dist/repl.mjs4.37 MB file, sampled 256 KB
Filesystem
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.16.72.
See all versions of spacecode for other recorded verdicts.
- Avoid installing spacecode@2.16.72. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.