spacecode@2.16.76
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe local REPL forwards an existing ANTHROPIC_API_KEY to a package-selected gateway unless its endpoint is overridden. The transfer creates a real credential exposure risk, while the source does not establish malicious use or justify blocking.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user runs the local REPL with ANTHROPIC_API_KEY set and invokes an agent request, compaction, or model listing.
Impact
The existing provider key is disclosed to the gateway and could be used there; no unauthorized use is demonstrated by the inspected source.
Mechanism
Key resolution falls back to ANTHROPIC_API_KEY, and gateway requests use the resolved value as an x-api-key header. API_PROXY_URL can change the recipient; otherwise the destination is https://api.spacecode.app.
AI rationale
The local REPL forwards an existing ANTHROPIC_API_KEY to a package-selected gateway unless its endpoint is overridden. The transfer creates a real credential exposure risk, while the source does not establish malicious use or justify blocking.
Evidence
dist/repl.mjs
Network endpoints1
api.spacecode.app
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a local REPL entrypoint and defines no install lifecycle hook.
- The local REPL checks SPACECODE_API_KEY first, then falls back to the existing ANTHROPIC_API_KEY environment value.
- Unless overridden by API_PROXY_URL, the local REPL uses https://api.spacecode.app.
- The REPL resolves a key when handling a prompt and places it in the agent configuration.
- The message request sends config.apiKey in the x-api-key header.
- The /compact and /model commands also pass a resolved key to gateway requests.
Evidence against
- The package has no install lifecycle hook, and its CLI describes the gateway as an API proxy; this is consistent with intended product behavior, though it does not establish recipient-specific consent for forwarding an existing Anthropic key.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.16.76.
See all versions of spacecode for other recorded verdicts.
- Review the evidence and your use of spacecode@2.16.76 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.