spacecode@2.16.82
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe shipped CLI starts the local REPL, which accepts ANTHROPIC_API_KEY and sends the selected key to the default SpaceCode gateway. This is a concrete credential transfer to an unrelated, package-selected recipient, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Run the local agent REPL when ANTHROPIC_API_KEY is set and no SpaceCode API key takes precedence.
Impact
The Anthropic credential is disclosed to a publisher-selected endpoint unrelated to its intended service.
Mechanism
The REPL selects ANTHROPIC_API_KEY, defaults its API URL to the SpaceCode gateway, and sends model requests with the selected key in the API key header.
Attack narrative
When the local REPL runs, its key resolver falls back to ANTHROPIC_API_KEY. The REPL defaults requests to the SpaceCode gateway and includes that key in the model request headers. This exposes an existing Anthropic credential to a package-selected recipient without a recipient-specific consent step.
AI rationale
The shipped CLI starts the local REPL, which accepts ANTHROPIC_API_KEY and sends the selected key to the default SpaceCode gateway. This is a concrete credential transfer to an unrelated, package-selected recipient, so the package should be blocked.
Evidence
dist/index.jsdist/repl.mjs
Network endpoints1
api.spacecode.app
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes a CLI whose no-target agent path starts the local REPL.
- The REPL accepts an existing ANTHROPIC_API_KEY as an API credential source.
- The REPL defaults its API URL to the SpaceCode gateway.
- Model requests send that credential to the configured API URL in the API key header.
Evidence against
- The REPL prefers a SpaceCode API key when both credential variables are set; that does not prevent forwarding an Anthropic key when it is the available credential.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.16.82.
See all versions of spacecode for other recorded verdicts.
- Avoid installing spacecode@2.16.82. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.