spacecode@2.17.8
SpaceCode - launch cloud dev environments with AI coding agents
AI Security Review
scanned 7h ago · by lpm-firewall-aiThe source confirms forwarding of an Anthropic credential to a package-selected gateway by default, without a recipient-specific consent gate. The branded gateway context may indicate intended proxy functionality, but does not establish consent to send an Anthropic service credential to that recipient.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Invoke the SpaceCode CLI in local REPL mode while ANTHROPIC_API_KEY is present in the environment.
Impact
The gateway receives a credential issued for Anthropic and could use it to access the associated API account.
Mechanism
The REPL resolves that environment value as its API key, builds a request to the configured gateway, and sends it in the x-api-key header.
Attack narrative
When the CLI enters local REPL mode, the bundled REPL accepts ANTHROPIC_API_KEY as a fallback credential. It sends model requests to the default SpaceCode gateway with that value in the x-api-key header, without recipient-specific confirmation in the inspected path.
AI rationale
The source confirms forwarding of an Anthropic credential to a package-selected gateway by default, without a recipient-specific consent gate. The branded gateway context may indicate intended proxy functionality, but does not establish consent to send an Anthropic service credential to that recipient.
Evidence
package.jsondist/index.jsdist/repl.mjs
Network endpoints1
api.spacecode.app/v1/messages
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The published CLI entrypoint reaches the local REPL when invoked without a cloud task or target.
- The REPL accepts ANTHROPIC_API_KEY as an API key fallback.
- The REPL defaults to the package-selected SpaceCode gateway and sends model requests there with that key in the x-api-key header.
- The request uses the resolved key from the active REPL configuration; the inspected path has no recipient-specific confirmation.
Evidence against
- The default recipient is a SpaceCode-branded gateway, consistent with the product’s proxy functionality.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcedist/index.jsView file
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
1122try {
L1123: const execAsync = (0, import_util.promisify)(import_child_process.exec);
L1124: const options = {};
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
baseUrl;
constructor(baseUrl, token) {
this.baseUrl = baseUrl ?? process.env.SPACECODE_API_URL ?? DEFAULT_API_URL;
const url = `${this.baseUrl}${path6}`;
headers["Authorization"] = `Bearer ${this.token}`;
throw new AuthError("Authentication failed. Please check your API key or run a command to re-authenticate");
const response = await fetch(`${this.baseUrl}/health`, {
const url = `${this.baseUrl}/api/auth/exchange`;
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsFindings
9 High5 Medium4 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/index.js
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Similaritydist/repl.mjs
HighKnown Malware Source Similaritydist/mcp/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/repl.mjs
MediumOversized Cli Entrypointdist/repl.mjs
Affected versions and remediation
This report applies to spacecode@2.17.8.
See all versions of spacecode for other recorded verdicts.
- Avoid installing spacecode@2.17.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.