spacecode@2.16.77
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe default REPL path accepts an Anthropic credential and forwards it to the package's profile backend as authentication. This is an unintended cross-service credential disclosure, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Starting the local REPL with ANTHROPIC_API_KEY set and profile loading enabled.
Impact
An Anthropic credential is disclosed to a package-selected service without recipient-specific consent.
Mechanism
The REPL treats that environment value as its API credential and sends it as a bearer token to the default SpaceCode profile endpoint.
Attack narrative
Starting the local REPL with ANTHROPIC_API_KEY set can send that key as a bearer token to SpaceCode's backend during profile loading. The default destination is selected by the package, and the source shows no recipient-specific consent check for this transfer. That disclosure is concrete attack behavior.
AI rationale
The default REPL path accepts an Anthropic credential and forwards it to the package's profile backend as authentication. This is an unintended cross-service credential disclosure, so the package should be blocked.
Evidence
package.jsondist/index.jsdist/repl.mjs
Network endpoints1
backend.spacecode.app
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest exposes dist/index.js as the CLI, whose default invocation starts the local REPL.
- The REPL accepts ANTHROPIC_API_KEY as an API credential before trying the saved SpaceCode token.
- The REPL uses that credential for profile requests to https://backend.spacecode.app by default.
- Profile preparation passes the resolved key to the backend client, which sends it as a bearer token to the profile API.
Evidence against
- SPACECODE_PROFILE=off suppresses profile preparation, and environment settings can override the backend URL; neither is an affirmative recipient-specific consent gate on the default path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.16.77.
See all versions of spacecode for other recorded verdicts.
- Avoid installing spacecode@2.16.77. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.