spacecode@2.16.79
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe active CLI path forwards an Anthropic credential to the package’s default gateway. This is concrete credential disclosure to a package-selected recipient, supporting a block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Run the SpaceCode REPL with `ANTHROPIC_API_KEY` set and invoke its model gateway.
Impact
The gateway receives the Anthropic credential, which could permit use of the associated account or API quota.
Mechanism
The REPL resolves the environment key, uses `api.spacecode.app` as the default gateway, and places the key in an `x-api-key` request header.
Attack narrative
When the REPL uses its model gateway, it can resolve `ANTHROPIC_API_KEY` from the environment and send that value in an `x-api-key` header. The gateway defaults to `api.spacecode.app`, a package-selected recipient. This is a credential transfer to the package service without a separate recipient-specific consent step.
AI rationale
The active CLI path forwards an Anthropic credential to the package’s default gateway. This is concrete credential disclosure to a package-selected recipient, supporting a block.
Evidence
package.jsondist/repl.mjs
Network endpoints1
api.spacecode.app/v1/models
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The published CLI launches the inspected REPL, where `ANTHROPIC_API_KEY` is accepted as a credential source.
- The REPL sends the key in an `x-api-key` header to its model gateway, which defaults to `https://api.spacecode.app`; the request path does not require an explicit per-recipient consent step.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
dist/repl.mjs4.39 MB file, sampled 256 KB
FilesystemNetwork
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.16.79.
See all versions of spacecode for other recorded verdicts.
- Avoid installing spacecode@2.16.79. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.