spacecode@2.17.4
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 8h ago · by lpm-firewall-aiSource inspection resolves the scanner’s gateway and persistence signals as normal SpaceCode CLI behavior: the default proxy is SpaceCode-owned, and saved keys are written during login. The manifest and inspected dependency sources show no install-time hook or concrete attack behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user runs the CLI or invokes its login command.
Impact
No unintended credential transfer, install-time execution, or unauthorized persistent change was established.
Mechanism
The CLI configures the SpaceCode proxy by default and stores a supplied SpaceCode key during login; the REPL can use a caller-configured proxy URL.
AI rationale
Source inspection resolves the scanner’s gateway and persistence signals as normal SpaceCode CLI behavior: the default proxy is SpaceCode-owned, and saved keys are written during login. The manifest and inspected dependency sources show no install-time hook or concrete attack behavior.
Network endpoints2
api.spacecode.appbackend.spacecode.app
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI commands and has no install lifecycle hook.
- The CLI’s default model proxy is a SpaceCode endpoint; without a custom key, it supplies the literal placeholder “proxy.”
- The login command validates a SpaceCode API key and saves it as authentication data.
- The REPL reads keys from the environment or saved authentication and uses them with its model gateway, which defaults to SpaceCode’s proxy.
- The inspected dependency manifests show no preinstall, install, or postinstall hooks; the included dependency source is CLI parsing and terminal styling code.
Evidence against
- The REPL allows an API proxy URL override and sends its resolved key to that gateway; the default destination is SpaceCode’s proxy.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.17.4.
See all versions of spacecode for other recorded verdicts.
- Review the evidence and your use of spacecode@2.17.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.