spacecode@2.17.14
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 5h ago · by lpm-firewall-aiThe normal local REPL path sends an existing Anthropic credential to SpaceCode’s default gateway as an authentication header, without recipient-specific consent or destination binding. This is a concrete credential disclosure and warrants blocking publication.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Run `spacecode` without a target and submit a prompt while `ANTHROPIC_API_KEY` is present.
Impact
The Anthropic credential and prompt are disclosed to the SpaceCode gateway.
Mechanism
The REPL resolves the environment key, uses `https://api.spacecode.app` by default, and sends the key in the request authentication header without a separate recipient-specific consent check.
Attack narrative
Running `spacecode` without a target starts the local REPL. For each submitted prompt, it resolves `SPACECODE_API_KEY` or falls back to `ANTHROPIC_API_KEY`, defaults to `https://api.spacecode.app`, and sends the resolved value in the `x-api-key` header. This discloses an existing Anthropic key to the package-selected host without a separate consent check.
AI rationale
The normal local REPL path sends an existing Anthropic credential to SpaceCode’s default gateway as an authentication header, without recipient-specific consent or destination binding. This is a concrete credential disclosure and warrants blocking publication.
Evidence
package.jsondist/index.jsdist/repl.mjs
Network endpoints1
api.spacecode.app
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` exposes `dist/index.js` as the `spacecode` CLI entry.
- With no target or cloud flags, the CLI starts the local REPL.
- The REPL checks `SPACECODE_API_KEY` and then falls back to `ANTHROPIC_API_KEY`.
- Each submitted prompt resolves that key and attaches it to the agent configuration.
- The REPL defaults to `https://api.spacecode.app` and sends requests with the resolved key in the `x-api-key` header.
Evidence against
- The REPL allows `API_PROXY_URL` to override its default host and prefers `SPACECODE_API_KEY` when both keys are present.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.17.14.
See all versions of spacecode for other recorded verdicts.
- Avoid installing spacecode@2.17.14. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.