spacecode@2.17.19

SpaceCode - launch cloud dev environments with AI coding agents

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and inspected login code stores the provided or SpaceCode-issued key. The scanner signals resolve to normal CLI behavior and opt-in telemetry rather than a confirmed attack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User invokes a SpaceCode CLI command; telemetry additionally requires a configured PostHog API key.

Impact

No confirmed unauthorized credential transfer, persistence, or destructive behavior was found.

Mechanism

The CLI sends authentication to its configured SpaceCode service. Telemetry uses a configurable PostHog host and is skipped when no API key is configured.

AI rationale

Network endpoints4

app.spacecode.appbackend.spacecode.appapi.spacecode.appus.i.posthog.com

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares command-line entrypoints and no lifecycle scripts.
Login validates and saves a SpaceCode API key; device login obtains its key through the configured SpaceCode authentication service.
Telemetry sends only when a PostHog API key is set, using a configurable host; this is not a hidden credential redirect.
Inspected dependency entrypoints show standard MCP, terminal styling, and command-line libraries.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.61 MB of source, external domains: api.github.com, api.spacecode.app, app.spacecode.app, backend.spacecode.app, github.com, reactjs.org, sandbox.spacecode.app, us.i.posthog.com

Oversized source lightweight scan

Source & flagged code

11 flagged

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = spacecode@2.17.17 matchedIdentity = npm:c3BhY2Vjb2Rl:2.17.17 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

727try { L728: const execAsync = (0, import_util.promisify)(import_child_process.exec); L729: const options = {};

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L727

727try { L728: const execAsync = (0, import_util.promisify)(import_child_process.exec); L729: const options = {};

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L727

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: await (0, import_promises.writeFile)((0, import_path.join)(getConfigDir(), "config.json"), JSON.stringify(config, null, 2), { mode: 384 }); await (0, import_promises.writeFile)(tmpPath, JSON.stringify(tasks2, null, 2)); await fd.writeFile(String(process.pid)); await (0, import_promises.writeFile)(authPath, JSON.stringify(auth, null, 2), { mode: 384 }); "Personal access tokens (sct_) were removed. Create an API key (sk_...) in the SpaceCode app and use `spacecode login --api-key <key>` or set SPACECODE_TOKEN to it." await (0, import_promises2.writeFile)(tmpPath, JSON.stringify(sessions, null, 2)); function createSandboxCl

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

727try { L728: const execAsync = (0, import_util.promisify)(import_child_process.exec); L729: const options = {}; ... L824: // ../../../../../../../../../[redacted]-client/dist/client.js L825: function createSandboxClient(baseUrl, token, options = {}) { L826: const actingUserId = options.actingUserId; ... L7321: if (stat2.size > 256 * 1024) continue; L7322: const content = fs.readFileSync(absPath, "utf-8"); L7323: this.options.send({ type: "file_sync", path: filePath, content });

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L727

38Cross-file remote execution chain: dist/index.js spawns dist/mcp/index.js; helper contains network access plus dynamic code execution. L38: function initPostHog() { L39: apiKey = process.env.POSTHOG_API_KEY || void 0; L40: host = (process.env.POSTHOG_HOST || host).replace(/\/+$/, ""); ... L46: if (!apiKey) return; L47: fetch(`${host}/capture/`, { L48: method: "POST", L49: headers: { "Content-Type": "application/json" }, L50: body: JSON.stringify({ L51: api_key: apiKey, ... L231: const data = await (0, import_promises.readFile)((0, import_path.join)(getConfigDir(), "config.json"), "utf-8"); L232: const parsed = JSON.parse(data); L233: if (!isPlainObject(parsed)) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L38

38function initPostHog() { L39: apiKey = process.env.POSTHOG_API_KEY || void 0; L40: host = (process.env.POSTHOG_HOST || host).replace(/\/+$/, ""); ... L46: if (!apiKey) return; L47: fetch(`${host}/capture/`, { L48: method: "POST", L49: headers: { "Content-Type": "application/json" }, L50: body: JSON.stringify({ L51: api_key: apiKey, ... L231: const data = await (0, import_promises.readFile)((0, import_path.join)(getConfigDir(), "config.json"), "utf-8"); L232: const parsed = JSON.parse(data); L233: if (!isPlainObject(parsed)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L38

dist/repl.mjsView file

•matchType = normalized_sha256 matchedPackage = spacecode@2.17.16 matchedPath = dist/repl.mjs matchedIdentity = npm:c3BhY2Vjb2Rl:2.17.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/repl.mjsView on unpkg

•path = dist/repl.mjs kind = oversized_source_file sizeBytes = 4660027 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/repl.mjsView on unpkg

•path = dist/repl.mjs kind = oversized_cli_entrypoint sizeBytes = 4660027 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/repl.mjsView on unpkg

dist/mcp/index.jsView file

•matchType = normalized_sha256 matchedPackage = spacecode@2.17.16 matchedPath = dist/mcp/index.js matchedIdentity = npm:c3BhY2Vjb2Rl:2.17.16 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/index.jsView on unpkg

Source & flagged code

11 flagged · loading source

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

727try { L728: const execAsync = (0, import_util.promisify)(import_child_process.exec); L729: const options = {};

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L727

727try { L728: const execAsync = (0, import_util.promisify)(import_child_process.exec); L729: const options = {};

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L727

Findings

1 Critical7 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

HighCredential Redirect Persistencedist/index.js

HighRemote Agent Bridgedist/index.js

HighCross File Remote Execution Contextdist/index.js

HighKnown Malware Source Similaritydist/repl.mjs

HighKnown Malware Source Similaritydist/mcp/index.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/repl.mjs

MediumOversized Cli Entrypointdist/repl.mjs

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to spacecode@2.17.19.

See all versions of spacecode for other recorded verdicts.

Review the evidence and your use of spacecode@2.17.19 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 00:11:33.240Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.