registry / stella-coder / 5.2.0

stella-coder@5.2.0

Stella Coder 5.0 — AI coding agent with Telegram bot, huge context, TDD, Git ecosystem, presentations, computer control, smart home, Office automation, and antivirus

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The user can explicitly start a Telegram bot with `/tg`; authorized incoming messages are executed through the package's print-mode AI agent. Print mode bypasses the normal file and shell permission prompts, leaving a remotely reachable high-privilege capability behind a weak four-digit authorization code.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs `stella` and `/tg`, then an authorized or code-obtaining Telegram account sends a message.

Impact

A compromised or newly authorized Telegram account can direct filesystem, shell, and network-capable agent actions in the launch directory.

Mechanism

Telegram polling forwards message text to a permission-bypassing AI agent via `execSync`.

Rationale

The package is not confirmed malware because it has no lifecycle trigger, no observed credential exfiltration chain, and no foreign agent-control mutation. Its explicit Telegram remote-control design nevertheless creates a material, weakly protected path to permission-bypassing agent execution.

Evidence

package.jsonstella-cli/index.mjsstella-cli/telegram-bot.mjsstella-cli/tools.mjsstella-cli/security.mjs.opencode/skills/ui-ux-pro-max/scripts/design_system.py~/.stella/telegram-auth.json~/.stella/sessions.json

Network endpoints2

api.telegram.org/bot<embedded-token>opencode.ai/zen/v1

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-10134

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in stella-coder (npm)

Details

stella-cli/telegram-bot.mjs hardcodes a Telegram bot API token (BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0") that is controlled by the package author. When the user invokes the /tg CLI command, the package starts a Telegram bot on the installer's machine that receives messages over api.telegram.org and passes them into execSync(`node stella-cli/index.mjs -p "${text}"`), invoking a shell-capable AI agent CLI with attacker-supplied input. Because the messaging channel is bound to a token the author retains, the author observes all bot traffic — including the 4-digit admin authorization code exchanged over that same channel — and can replay it to reach the command-execution path on any installer that enables /tg. telegram-bot.mjs additionally sends os.hostname() and os.userInfo().username to the same author-controlled bot. A hardcoded PREMIUM_CODE = "10102013" acts as a universal activation key that unlocks the remote-control feature-set without payment. package.json sets "main": "stella-cli/index.mjs", whose top-level executes main() and starts the interactive CLI on require/import, extending the reach of the /tg surface beyond the bin entry. There are no install lifecycle hooks; the backdoor fires when the user runs the CLI (or a consumer imports the module) and invokes /tg.

References

OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

`stella-cli/telegram-bot.mjs` embeds a Telegram bot credential and polls its API.
Authenticated Telegram messages reach `execSync` running `stella-cli/index.mjs -p` with message text.
`-p` mode auto-approves all AI tool permissions in `stella-cli/index.mjs`.
The invoked agent exposes filesystem, shell, and web tools through `stella-cli/tools.mjs`.
Telegram authorization uses a four-digit one-time admin code in `stella-cli/telegram-bot.mjs`.
No npm lifecycle scripts exist in `package.json`.

Evidence against

Remote control is an advertised `/tg` feature, started by an explicit CLI command.
No install-time execution or preinstall/install/postinstall hook was found.
No source writes to foreign AI-agent configuration surfaces were found.
Telegram command handling checks the local authorized-user list before execution.
`.opencode` contains readable skill sources and ordinary Python bytecode caches, not a confirmed staged payload.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 942 KB of source, external domains: api.duckduckgo.com, api.telegram.org, discord.gg, fonts.googleapis.com, github.com, html.duckduckgo.com, ollama.com, opencode.ai, www.google.com, www.kinopoisk.ru, www.virustotal.com, www.youtube.com

Source & flagged code

11 flagged

dist/security.mjsView file

Lines 1-24javascript

1import crypto from "node:crypto"

2import fs from "node:fs"

3import path from "node:path"

4import os from "node:os"

5import { execSync } from "node:child_process"

6import { fileURLToPath } from "node:url"

High

Child Process

Package source references child process execution.

dist/security.mjsView on unpkg · L4

8const __filename = fileURLToPath(import.meta.url)

9const __dirname = path.dirname(__filename)

11const STELLA_HIDDEN = path.join(os.homedir(), ".stella", ".secure")

12const KEY_FILE = path.join(STELLA_HIDDEN, "vault.dat")

13const FINGERPRINT_FILE = path.join(STELLA_HIDDEN, ".fp")

14const INTEGRITY_FILE = path.join(STELLA_HIDDEN, ".integrity")

15const LOCKOUT_FILE = path.join(STELLA_HIDDEN, ".lockout")

17const CLI_FILES = [

18 "stella-cli/index.mjs",

19 "stella-cli/tools.mjs",

20 "stella-cli/banner.mjs",

21 "stella-cli/theme.mjs",

22 "stella-cli/markdown.mjs",

23 "stella-cli/security.mjs",

24]

dist/antimalware/scanner.mjsView file

Lines 316-356javascript

316// ═══════════════════════════════════════════════════════════════

317

318export function scanRunningProcesses() {

319 const results = []

320

321 // Known safe Windows processes

322 const SAFE_PROCESSES = new Set([

323 "WMIRegistrationService.exe", "WmiPrvSE.exe", "WmiApSrv.exe",

324 "svchost.exe", "services.exe", "lsass.exe", "wininit.exe",

325 "csrss.exe", "smss.exe", "winlogon.exe", "dwm.exe",

326 "explorer.exe", "taskhostw.exe", "conhost.exe",

327 "RuntimeBroker.exe", "ShellExperienceHost.exe", "StartMenuExperienceHost.exe",

328 "SearchUI.exe", "SearchIndexer.exe", "SearchProtocolHost.exe",

329 "SiHost.exe", "fontdrvhost.exe", "dllhost.exe",

330 "spoolsv.exe", "SearchFilterHost.exe", "WUDFHost.exe",

331 "msdtc.exe", "WerFault.exe", "WerMgr.exe",

332 "audiodg.exe", "mmsysse.exe", "ctfmon.exe",

333 "notepad.exe", "calc.exe", "mspaint.exe",

334 "chrome.exe", "firefox.exe", "msedge.exe", "opera.exe",

335 "Code.exe", "node.exe", "pnpm.exe", "npm.exe",

336 "ollama.exe", "ollama_llama_server.exe",

337 "powershell.exe", "pwsh.exe", "cmd.exe",

338 "WindowsTerminal.exe", "wt.exe",

High

Shell

Package source references shell execution.

dist/antimalware/scanner.mjsView on unpkg · L336

339 "SecurityHealthService.exe", "SecurityHealthSystray.exe",

340 "MpCmdRun.exe", "MsMpEng.exe",

341 "NisSrv.exe", "WdNisSvc.exe",

342 "ApplicationFrameHost.exe", "SystemSettings.exe",

343 "TextInputHost.exe", "CompPkgSrv.exe",

344 "backgroundTaskHost.exe", "hctool.exe",

345 "KasperskyLab.exe", "avp.exe", "avpui.exe",

346 "OneDrive.exe", "onedrive.exe",

347 "Teams.exe", "Slack.exe", "Discord.exe",

348 "Spotify.exe", "Steam.exe", "EpicGamesLauncher.exe",

349 "vmwaretray.exe", "vmwareuser.exe", "vmtoolsd.exe",

350 "vboxservice.exe", "vboxtray.exe",

351 "Docker Desktop.exe", "com.docker.backend.exe",

352 "zoom.exe", "Zoom.exe",

353 ])

354

355 try {

356 const output = execSync("tasklist /FO CSV /NH", { encoding: "utf8", timeout: 10000 })

dist/antimalware/database.mjsView file

Lines 145-185javascript

145 // ══════ EXPLOITS ══════

146 { id: "SIG-031", name: "Metasploit стейджинг", severity: "critical", category: "exploit",

147 pattern: /msfvenom[\s\S]{0,100}reverse[\s\S]{0,50}(tcp|http|https)[\s\S]{0,100}(meterpreter|shell|vnc)/ },

148

149 { id: "SIG-032", name: "Meterpreter payload", severity: "critical", category: "exploit",

150 pattern: /meterpreter[\s\S]{0,100}(reverse_tcp|reverse_http|reverse_https)[\s\S]{0,100}(LHOST|LPORT)/ },

151

152 { id: "SIG-033", name: "Shellcode detector", severity: "critical", category: "exploit",

153 pattern: /(\x31\xc0|\x31\xdb|\x31\xc9|\x31\xd2|\x90{8,})[\s\S]{0,50}(\\x6a|\\x58|\\xcd|\\x80)/ },

154

155 { id: "SIG-034", name: "ROP chain", severity: "high", category: "exploit",

156 pattern: /gadget[\s\S]{0,50}(pop[\s\S]{0,20}ret|call[\s\S]{0,20}eax|jmp[\s\S]{0,20}esp)/ },

157

158 // ══════ PRIVILEGE ESCALATION ══════

159 { id: "SIG-035", name: "UAC bypass", severity: "critical", category: "privesc",

160 pattern: /(fodhelper|eventvwr|computerdefaults|sdclt|slui)[\s\S]{0,100}(ms-settings|HKCU|CurrentVersion)\\Run/ },

161

162 { id: "SIG-036", name: "Token impersonation", severity: "critical", category: "privesc",

163 pattern: /ImpersonateLoggedOnUser|DuplicateTokenEx|SetThreadToken[\s\S]{0,100}(AdjustTokenPrivileges|SeDebugPrivilege)/ },

164

165 { id: "SIG-037", name: "Service install", severity: "high", category: "privesc",

166 pattern: /CreateService[\s\S]{0,100}(SERVICE_AUTO_START|SERVICE_WIN32_OWN_PROCESS)[\s\S]{0,100}(cmd|powershell|bash)/ },

167

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/antimalware/database.mjsView on unpkg · L165

168 // ══════ ANTI-ANALYSIS ══════

169 { id: "SIG-038", name: "VM detection", severity: "high", category: "anti-analysis",

170 pattern: /(VMware|VirtualBox|QEMU|Hyper-V|Xen)[\s\S]{0,100}(CPUID|cpuid|__cpuid|vmexit|vmcall)/ },

171

172 { id: "SIG-039", name: "Debugger detection", severity: "high", category: "anti-analysis",

173 pattern: /IsDebuggerPresent|CheckRemoteDebuggerPresent|NtQueryInformationProcess[\s\S]{0,100}ProcessDebugPort/ },

174

175 { id: "SIG-040", name: "Sandbox detection", severity: "high", category: "anti-analysis",

176 pattern: /(NtQuerySystemInformation|GetTickCount|timeGetTime)[\s\S]{0,100}(anti-vm|anti-debug|sandbox|sleep|delay)/i },

177

178 { id: "SIG-041", name: "AMSI bypass", severity: "critical", category: "anti-analysis",

179 pattern: /AmsiUtils[\s\S]{0,100}amsiInitFailed|AmsiScanBuffer[\s\S]{0,100}0x80070057|SetProcessMitigationPolicy[\s\S]{0,50}DisableDynamicCode/ },

180

181 { id: "SIG-042", name: "ETW patch", severity: "critical", category: "anti-analysis",

182 pattern: /EtwEventWrite[\s\S]{0,100}(patch|nop|ret|0xc3)|NtTraceEvent[\s\S]{0,100}(hook|detour)/ },

183

184 // ══════ PERSISTENCE ══════

185 { id: "SIG-043", name: "Registry Run key", severity: "high", category: "persistence",

dist/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Stella Coder 3.9 — терминальный AI-агент

3import readline from "node:readline"

4import fs from "node:fs"

5import path from "node:path"

6import os from "node:os"

7import { execSync } from "node:child_process"

8import { streamText, stepCountIs, generateText } from "ai"

9import { createOpenAICompatible } from "@ai-sdk/openai-compatible"

10import { createTools } from "./tools.mjs"

11import { printBanner } from "./banner.mjs"

12import { createStreamRenderer, renderMarkdown } from "./markdown.mjs"

13import {

14 bold, dim, violet, purple, indigo, blue, cyan, green, red, yellow, gray, darkGray, white,

15 gradientLine, box, SPINNER_FRAMES, SPINNER_WORDS,

16} from "./theme.mjs"

17import {

18 verifyCodeIntegrity, getApiKey, saveApiKey, deleteApiKey,

19 getHardwareInfo, saveIntegrityHash,

20} from "./security.mjs"

22const VERSION = "3.9.2"

23const CONFIG_DIR = path.join(os.homedir(), ".stella")

24const CONFIG_PATH = path.join(CONFIG_DIR, "config.json")

25const HISTORY_PATH = path.join(CONFIG_DIR, "history.json")

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.mjsView on unpkg · L6

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.mjsView on unpkg · L6

Lines 1351-1391javascript

1351 return

1352 }

1353

1354 // ═══════════════════════════════════════════════════

1355 // ТЕСТИРОВАНИЕ И СБОРКА

1356 // ═══════════════════════════════════════════════════

1357 case "/test": {

1358 const testCmd = arg || "npm test"

1359 console.log(dim(`\n Запускаю: ${testCmd}\n`))

1360 try {

1361 const { execSync } = await import("node:child_process")

1362 const result = execSync(testCmd, { encoding: "utf8", stdio: "inherit" })

1363 } catch (e) {

1364 console.log(red(`\n ✗ Тесты завершились с ошибкой\n`))

1365 }

1366 return

1367 }

1368 case "/lint": {

1369 const lintCmd = arg || "npm run lint"

1370 console.log(dim(`\n Запускаю: ${lintCmd}\n`))

1371 try {

1372 const { execSync } = await import("node:child_process")

1373 execSync(lintCmd, { encoding: "utf8", stdio: "inherit" })

1374 } catch {

1375 console.log(red(`\n ✗ Линтер завершился с ошибкой\n`))

1376 }

1377 return

1378 }

1379 case "/format": {

1380 const formatCmd = arg || "npx prettier --write ."

1381 console.log(dim(`\n Форматирую: ${formatCmd}\n`))

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L1371

1382 try {

1383 const { execSync } = await import("node:child_process")

1384 execSync(formatCmd, { encoding: "utf8", stdio: "inherit" })

1385 console.log(green("\n ✓ Код отформатирован\n"))

1386 } catch {

1387 console.log(red(`\n ✗ Ошибка форматирования\n`))

1388 }

1389 return

1390 }

1391 case "/typecheck": {

stella-cli/telegram-bot.mjsView file

Lines 1-24javascript

1import fs from "node:fs"

2import path from "node:path"

3import os from "node:os"

4import crypto from "node:crypto"

5import { execSync } from "node:child_process"

7// ═══════════════════════════════════════════════════════════════════

8// STELLA TELEGRAM BOT — удалённое управление + сессии + premium

9// ═══════════════════════════════════════════════════════════════════

11const BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0"

12const API_URL = `https://api.telegram.org/bot${BOT_TOKEN}`

13const PREMIUM_CODE = "10102013"

14const PREMIUM_DURATION = 30 * 24 * 60 * 60 * 1000 // 30 дней

16const CONFIG_DIR = path.join(os.homedir(), ".stella")

17const BOT_CONFIG_PATH = path.join(CONFIG_DIR, "telegram-bot.json")

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

stella-cli/telegram-bot.mjsView on unpkg · L4

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

stella-cli/telegram-bot.mjsView on unpkg · L4

18const SESSIONS_PATH = path.join(CONFIG_DIR, "sessions.json")

19const AUTH_PATH = path.join(CONFIG_DIR, "telegram-auth.json")

21// ═══════════════════════════════════════════════════════════════════

22// 1. TELEGRAM API — прямые вызовы без зависимостей

23// ═══════════════════════════════════════════════════════════════════

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 57424 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 57424 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

stella-cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = stella-coder@5.1.0 matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.1.0 similarity = 0.938 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

stella-cli/index.mjsView on unpkg

Source & flagged code

11 flagged · loading source

dist/security.mjsView file

4import os from "node:os" L5: import { execSync } from "node:child_process" L6: import { fileURLToPath } from "node:url"

High

Child Process

Package source references child process execution.

dist/security.mjsView on unpkg · L4

dist/antimalware/scanner.mjsView file

336"ollama.exe", "ollama_llama_server.exe", L337: "powershell.exe", "pwsh.exe", "cmd.exe", L338: "WindowsTerminal.exe", "wt.exe",

High

Shell

Package source references shell execution.

dist/antimalware/scanner.mjsView on unpkg · L336

dist/antimalware/database.mjsView file

165{ id: "SIG-037", name: "Service install", severity: "high", category: "privesc", L166: pattern: /CreateService[\s\S]{0,100}(SERVICE_AUTO_START|SERVICE_WIN32_OWN_PROCESS)[\s\S]{0,100}(cmd|powershell|bash)/ }, L167: ... L188: { id: "SIG-044", name: "Scheduled task", severity: "high", category: "persistence", L189: pattern: /schtasks[\s\S]{0,100}(\/create|\/Create)[\s\S]{0,100}(cmd|powershell|bash|python|perl)/ }, L190: ... L207: { id: "SIG-050", name: "DNS tunneling", severity: "high", category: "backdoor", L208: pattern: /DnsQuery[\s\S]{0,100}(TXT|MX|CNAME)[\s\S]{0,100}(encode|decode|base64)[\s\S]{0,100}(socket|connect)/ }, L209: ... L240: { id: "SIG-060", name: "HTTP POST exfil", severity: "high", category: "exfil", L241: pattern: /(fetch|XMLHttpRequest|axios|http\.request|request\()[\s\S]{0,200}(POST|PUT)[\s\S]{0,200}(password|token|secret|credential|cookie)/ }, L242:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/antimalware/database.mjsView on unpkg · L165

dist/index.mjsView file

6Cross-file remote execution chain: dist/index.mjs spawns dist/tools.mjs; helper contains network access plus dynamic code execution. L6: import os from "node:os" L7: import { execSync } from "node:child_process" L8: import { streamText, stepCountIs, generateText } from "ai" ... L22: const VERSION = "3.9.2" L23: const CONFIG_DIR = path.join(os.homedir(), ".stella") L24: const CONFIG_PATH = path.join(CONFIG_DIR, "config.json") ... L26: L27: const ZEN_BASE_URL = "https://opencode.ai/zen/v1" L28: ... L53: function loadConfig() { L54: try { return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8")) } catch { return {} } L55: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.mjsView on unpkg · L6

1371try { L1372: const { execSync } = await import("node:child_process") L1373: execSync(lintCmd, { encoding: "utf8", stdio: "inherit" }) ... L1379: case "/format": { L1380: const formatCmd = arg || "npx prettier --write ." L1381: console.log(dim(`\n Форматирую: ${formatCmd}\n`))

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L1371

6import os from "node:os" L7: import { execSync } from "node:child_process" L8: import { streamText, stepCountIs, generateText } from "ai" ... L22: const VERSION = "3.9.2" L23: const CONFIG_DIR = path.join(os.homedir(), ".stella") L24: const CONFIG_PATH = path.join(CONFIG_DIR, "config.json") ... L26: L27: const ZEN_BASE_URL = "https://opencode.ai/zen/v1" L28: ... L53: function loadConfig() { L54: try { return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8")) } catch { return {} } L55: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.mjsView on unpkg · L6

stella-cli/telegram-bot.mjsView file

4import crypto from "node:crypto" L5: import { execSync } from "node:child_process" L6: ... L11: const BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0" L12: const API_URL = `https://api.telegram.org/bot${BOT_TOKEN}` L13: const PREMIUM_CODE = "10102013" ... L15: L16: const CONFIG_DIR = path.join(os.homedir(), ".stella") L17: const BOT_CONFIG_PATH = path.join(CONFIG_DIR, "telegram-bot.json") ... L29: headers: { "Content-Type": "application/json" }, L30: body: JSON.stringify(body), L31: signal: AbortSignal.timeout(30000),

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

stella-cli/telegram-bot.mjsView on unpkg · L4

4Trigger-reachable chain: manifest.main -> stella-cli/index.mjs -> stella-cli/telegram-bot.mjs L4: import crypto from "node:crypto" L5: import { execSync } from "node:child_process" L6: ... L11: const BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0" L12: const API_URL = `https://api.telegram.org/bot${BOT_TOKEN}` L13: const PREMIUM_CODE = "10102013" ... L15: L16: const CONFIG_DIR = path.join(os.homedir(), ".stella") L17: const BOT_CONFIG_PATH = path.join(CONFIG_DIR, "telegram-bot.json") ... L29: headers: { "Content-Type": "application/json" }, L30: body: JSON.stringify(body), L31: signal: AbortSignal.timeout(30000),

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

stella-cli/telegram-bot.mjsView on unpkg · L4

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 57424 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 57424 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

stella-cli/index.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

stella-cli/index.mjsView on unpkg

Findings

3 Critical5 High5 Medium5 Low

CriticalCredential Exfiltrationstella-cli/telegram-bot.mjs

CriticalTrigger Reachable Dangerous Capabilitystella-cli/telegram-bot.mjs

CriticalPrevious Version Dangerous Deltastella-cli/index.mjs

HighChild Processdist/security.mjs

HighShelldist/antimalware/scanner.mjs

HighCross File Remote Execution Contextdist/index.mjs

HighRuntime Package Installdist/index.mjs

HighPayload In Excluded Dir.opencode/skills/ui-ux-pro-max/scripts/design_system.py

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.mjs

MediumShips Build Helper.opencode/skills/ui-ux-pro-max/scripts/design_system.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/antimalware/database.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

dist/security.mjsView file

Lines 1-24javascript

1import crypto from "node:crypto"

2import fs from "node:fs"

3import path from "node:path"

4import os from "node:os"

5import { execSync } from "node:child_process"

6import { fileURLToPath } from "node:url"

High

Child Process

Package source references child process execution.

dist/security.mjsView on unpkg · L4

8const __filename = fileURLToPath(import.meta.url)

9const __dirname = path.dirname(__filename)

11const STELLA_HIDDEN = path.join(os.homedir(), ".stella", ".secure")

12const KEY_FILE = path.join(STELLA_HIDDEN, "vault.dat")

13const FINGERPRINT_FILE = path.join(STELLA_HIDDEN, ".fp")

14const INTEGRITY_FILE = path.join(STELLA_HIDDEN, ".integrity")

15const LOCKOUT_FILE = path.join(STELLA_HIDDEN, ".lockout")

17const CLI_FILES = [

18 "stella-cli/index.mjs",

19 "stella-cli/tools.mjs",

20 "stella-cli/banner.mjs",

21 "stella-cli/theme.mjs",

22 "stella-cli/markdown.mjs",

23 "stella-cli/security.mjs",

24]

dist/antimalware/scanner.mjsView file

Lines 316-356javascript

316// ═══════════════════════════════════════════════════════════════

317

318export function scanRunningProcesses() {

319 const results = []

320

321 // Known safe Windows processes

322 const SAFE_PROCESSES = new Set([

323 "WMIRegistrationService.exe", "WmiPrvSE.exe", "WmiApSrv.exe",

324 "svchost.exe", "services.exe", "lsass.exe", "wininit.exe",

325 "csrss.exe", "smss.exe", "winlogon.exe", "dwm.exe",

326 "explorer.exe", "taskhostw.exe", "conhost.exe",

327 "RuntimeBroker.exe", "ShellExperienceHost.exe", "StartMenuExperienceHost.exe",

328 "SearchUI.exe", "SearchIndexer.exe", "SearchProtocolHost.exe",

329 "SiHost.exe", "fontdrvhost.exe", "dllhost.exe",

330 "spoolsv.exe", "SearchFilterHost.exe", "WUDFHost.exe",

331 "msdtc.exe", "WerFault.exe", "WerMgr.exe",

332 "audiodg.exe", "mmsysse.exe", "ctfmon.exe",

333 "notepad.exe", "calc.exe", "mspaint.exe",

334 "chrome.exe", "firefox.exe", "msedge.exe", "opera.exe",

335 "Code.exe", "node.exe", "pnpm.exe", "npm.exe",

336 "ollama.exe", "ollama_llama_server.exe",

337 "powershell.exe", "pwsh.exe", "cmd.exe",

338 "WindowsTerminal.exe", "wt.exe",

High

Shell

Package source references shell execution.

dist/antimalware/scanner.mjsView on unpkg · L336

339 "SecurityHealthService.exe", "SecurityHealthSystray.exe",

340 "MpCmdRun.exe", "MsMpEng.exe",

341 "NisSrv.exe", "WdNisSvc.exe",

342 "ApplicationFrameHost.exe", "SystemSettings.exe",

343 "TextInputHost.exe", "CompPkgSrv.exe",

344 "backgroundTaskHost.exe", "hctool.exe",

345 "KasperskyLab.exe", "avp.exe", "avpui.exe",

346 "OneDrive.exe", "onedrive.exe",

347 "Teams.exe", "Slack.exe", "Discord.exe",

348 "Spotify.exe", "Steam.exe", "EpicGamesLauncher.exe",

349 "vmwaretray.exe", "vmwareuser.exe", "vmtoolsd.exe",

350 "vboxservice.exe", "vboxtray.exe",

351 "Docker Desktop.exe", "com.docker.backend.exe",

352 "zoom.exe", "Zoom.exe",

353 ])

354

355 try {

356 const output = execSync("tasklist /FO CSV /NH", { encoding: "utf8", timeout: 10000 })

dist/antimalware/database.mjsView file

Lines 145-185javascript

145 // ══════ EXPLOITS ══════

146 { id: "SIG-031", name: "Metasploit стейджинг", severity: "critical", category: "exploit",

147 pattern: /msfvenom[\s\S]{0,100}reverse[\s\S]{0,50}(tcp|http|https)[\s\S]{0,100}(meterpreter|shell|vnc)/ },

148

149 { id: "SIG-032", name: "Meterpreter payload", severity: "critical", category: "exploit",

150 pattern: /meterpreter[\s\S]{0,100}(reverse_tcp|reverse_http|reverse_https)[\s\S]{0,100}(LHOST|LPORT)/ },

151

152 { id: "SIG-033", name: "Shellcode detector", severity: "critical", category: "exploit",

153 pattern: /(\x31\xc0|\x31\xdb|\x31\xc9|\x31\xd2|\x90{8,})[\s\S]{0,50}(\\x6a|\\x58|\\xcd|\\x80)/ },

154

155 { id: "SIG-034", name: "ROP chain", severity: "high", category: "exploit",

156 pattern: /gadget[\s\S]{0,50}(pop[\s\S]{0,20}ret|call[\s\S]{0,20}eax|jmp[\s\S]{0,20}esp)/ },

157

158 // ══════ PRIVILEGE ESCALATION ══════

159 { id: "SIG-035", name: "UAC bypass", severity: "critical", category: "privesc",

160 pattern: /(fodhelper|eventvwr|computerdefaults|sdclt|slui)[\s\S]{0,100}(ms-settings|HKCU|CurrentVersion)\\Run/ },

161

162 { id: "SIG-036", name: "Token impersonation", severity: "critical", category: "privesc",

163 pattern: /ImpersonateLoggedOnUser|DuplicateTokenEx|SetThreadToken[\s\S]{0,100}(AdjustTokenPrivileges|SeDebugPrivilege)/ },

164

165 { id: "SIG-037", name: "Service install", severity: "high", category: "privesc",

166 pattern: /CreateService[\s\S]{0,100}(SERVICE_AUTO_START|SERVICE_WIN32_OWN_PROCESS)[\s\S]{0,100}(cmd|powershell|bash)/ },

167

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/antimalware/database.mjsView on unpkg · L165

168 // ══════ ANTI-ANALYSIS ══════

169 { id: "SIG-038", name: "VM detection", severity: "high", category: "anti-analysis",

170 pattern: /(VMware|VirtualBox|QEMU|Hyper-V|Xen)[\s\S]{0,100}(CPUID|cpuid|__cpuid|vmexit|vmcall)/ },

171

172 { id: "SIG-039", name: "Debugger detection", severity: "high", category: "anti-analysis",

173 pattern: /IsDebuggerPresent|CheckRemoteDebuggerPresent|NtQueryInformationProcess[\s\S]{0,100}ProcessDebugPort/ },

174

175 { id: "SIG-040", name: "Sandbox detection", severity: "high", category: "anti-analysis",

176 pattern: /(NtQuerySystemInformation|GetTickCount|timeGetTime)[\s\S]{0,100}(anti-vm|anti-debug|sandbox|sleep|delay)/i },

177

178 { id: "SIG-041", name: "AMSI bypass", severity: "critical", category: "anti-analysis",

179 pattern: /AmsiUtils[\s\S]{0,100}amsiInitFailed|AmsiScanBuffer[\s\S]{0,100}0x80070057|SetProcessMitigationPolicy[\s\S]{0,50}DisableDynamicCode/ },

180

181 { id: "SIG-042", name: "ETW patch", severity: "critical", category: "anti-analysis",

182 pattern: /EtwEventWrite[\s\S]{0,100}(patch|nop|ret|0xc3)|NtTraceEvent[\s\S]{0,100}(hook|detour)/ },

183

184 // ══════ PERSISTENCE ══════

185 { id: "SIG-043", name: "Registry Run key", severity: "high", category: "persistence",

dist/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Stella Coder 3.9 — терминальный AI-агент

3import readline from "node:readline"

4import fs from "node:fs"

5import path from "node:path"

6import os from "node:os"

7import { execSync } from "node:child_process"

8import { streamText, stepCountIs, generateText } from "ai"

9import { createOpenAICompatible } from "@ai-sdk/openai-compatible"

10import { createTools } from "./tools.mjs"

11import { printBanner } from "./banner.mjs"

12import { createStreamRenderer, renderMarkdown } from "./markdown.mjs"

13import {

14 bold, dim, violet, purple, indigo, blue, cyan, green, red, yellow, gray, darkGray, white,

15 gradientLine, box, SPINNER_FRAMES, SPINNER_WORDS,

16} from "./theme.mjs"

17import {

18 verifyCodeIntegrity, getApiKey, saveApiKey, deleteApiKey,

19 getHardwareInfo, saveIntegrityHash,

20} from "./security.mjs"

22const VERSION = "3.9.2"

23const CONFIG_DIR = path.join(os.homedir(), ".stella")

24const CONFIG_PATH = path.join(CONFIG_DIR, "config.json")

25const HISTORY_PATH = path.join(CONFIG_DIR, "history.json")

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.mjsView on unpkg · L6

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.mjsView on unpkg · L6

Lines 1351-1391javascript

1351 return

1352 }

1353

1354 // ═══════════════════════════════════════════════════

1355 // ТЕСТИРОВАНИЕ И СБОРКА

1356 // ═══════════════════════════════════════════════════

1357 case "/test": {

1358 const testCmd = arg || "npm test"

1359 console.log(dim(`\n Запускаю: ${testCmd}\n`))

1360 try {

1361 const { execSync } = await import("node:child_process")

1362 const result = execSync(testCmd, { encoding: "utf8", stdio: "inherit" })

1363 } catch (e) {

1364 console.log(red(`\n ✗ Тесты завершились с ошибкой\n`))

1365 }

1366 return

1367 }

1368 case "/lint": {

1369 const lintCmd = arg || "npm run lint"

1370 console.log(dim(`\n Запускаю: ${lintCmd}\n`))

1371 try {

1372 const { execSync } = await import("node:child_process")

1373 execSync(lintCmd, { encoding: "utf8", stdio: "inherit" })

1374 } catch {

1375 console.log(red(`\n ✗ Линтер завершился с ошибкой\n`))

1376 }

1377 return

1378 }

1379 case "/format": {

1380 const formatCmd = arg || "npx prettier --write ."

1381 console.log(dim(`\n Форматирую: ${formatCmd}\n`))

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L1371

1382 try {

1383 const { execSync } = await import("node:child_process")

1384 execSync(formatCmd, { encoding: "utf8", stdio: "inherit" })

1385 console.log(green("\n ✓ Код отформатирован\n"))

1386 } catch {

1387 console.log(red(`\n ✗ Ошибка форматирования\n`))

1388 }

1389 return

1390 }

1391 case "/typecheck": {

stella-cli/telegram-bot.mjsView file

Lines 1-24javascript

1import fs from "node:fs"

2import path from "node:path"

3import os from "node:os"

4import crypto from "node:crypto"

5import { execSync } from "node:child_process"

8// STELLA TELEGRAM BOT — удалённое управление + сессии + premium

11const BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0"

12const API_URL = `https://api.telegram.org/bot${BOT_TOKEN}`

13const PREMIUM_CODE = "10102013"

14const PREMIUM_DURATION = 30 * 24 * 60 * 60 * 1000 // 30 дней

16const CONFIG_DIR = path.join(os.homedir(), ".stella")

17const BOT_CONFIG_PATH = path.join(CONFIG_DIR, "telegram-bot.json")

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

stella-cli/telegram-bot.mjsView on unpkg · L4

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

stella-cli/telegram-bot.mjsView on unpkg · L4

18const SESSIONS_PATH = path.join(CONFIG_DIR, "sessions.json")

19const AUTH_PATH = path.join(CONFIG_DIR, "telegram-auth.json")

22// 1. TELEGRAM API — прямые вызовы без зависимостей

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 57424 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 57424 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

stella-cli/index.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

stella-cli/index.mjsView on unpkg