spacecode@2.16.97
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 22h ago · by lpm-firewall-aiThe default local REPL automatically forwards ANTHROPIC_API_KEY to the SpaceCode backend during prompt loading. This is an unconsented credential disclosure to a recipient unrelated to the key’s intended service, so publication should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Starting the local REPL with ANTHROPIC_API_KEY set.
Impact
The Anthropic credential is disclosed to the SpaceCode backend, where it can be used outside its intended Anthropic service context.
Mechanism
The REPL resolves ANTHROPIC_API_KEY as its API credential and sends it in authorization headers to the prompt endpoint on the configured backend, which defaults to backend.spacecode.app.
Attack narrative
Starting the local REPL automatically loads prompt templates. Its credential resolver accepts ANTHROPIC_API_KEY, and the loader sends the value as bearer and x-api-key credentials to the backend prompt endpoint, defaulting to backend.spacecode.app. This transfers an Anthropic service credential to a package-selected recipient without a recipient-specific consent gate.
AI rationale
The default local REPL automatically forwards ANTHROPIC_API_KEY to the SpaceCode backend during prompt loading. This is an unconsented credential disclosure to a recipient unrelated to the key’s intended service, so publication should be blocked.
Evidence
package.jsondist/index.jsdist/repl.mjs
Network endpoints1
backend.spacecode.app
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes a CLI entrypoint that starts the local REPL when invoked without a task target.
- The REPL accepts ANTHROPIC_API_KEY as its API credential.
- The prompt loader sends that credential to the configured backend, defaulting to backend.spacecode.app.
- The REPL invokes the prompt loader automatically on startup.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Oversized source lightweight scan
dist/repl.mjs4.43 MB file, sampled 256 KB
Filesystem
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.16.97.
See all versions of spacecode for other recorded verdicts.
- Avoid installing spacecode@2.16.97. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.