spacecode@2.17.12
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 6h ago · by lpm-firewall-aiSource inspection resolves the credential redirect hint as the product's configurable API proxy and backend flow; the launch path does not forward an existing Anthropic key by default. The package has no install hook, and the inspected telemetry path is gated by POSTHOG_API_KEY, so the static similarity and behavior hints do not establish an attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
The CLI runs a user-selected command; telemetry is sent only when POSTHOG_API_KEY is present.
Impact
No unconsented credential transfer or other concrete attack impact was established.
Mechanism
Launch configures either a placeholder key and SpaceCode proxy or a separately supplied key. The REPL sends its API key to the configured backend.
AI rationale
Source inspection resolves the credential redirect hint as the product's configurable API proxy and backend flow; the launch path does not forward an existing Anthropic key by default. The package has no install hook, and the inspected telemetry path is gated by POSTHOG_API_KEY, so the static similarity and behavior hints do not establish an attack.
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the CLI entrypoints and declares no install lifecycle script; inspected dependency sources are terminal styling, command parsing, and MCP SDK code.
- The launch command uses a placeholder key with the SpaceCode proxy by default; a supplied custom key is a separate explicit option.
- The REPL reads API keys from environment variables or local SpaceCode auth and sends them to a configurable backend URL.
- Telemetry sends only when POSTHOG_API_KEY is set; the inspected code shows no automatic install-time disclosure.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.17.12.
See all versions of spacecode for other recorded verdicts.
- Review the evidence and your use of spacecode@2.17.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.