registry / stella-coder / 5.3.0

stella-coder@5.3.0

Stella Coder 5.0 — AI coding agent with Telegram bot, huge context, TDD, Git ecosystem, presentations, computer control, smart home, Office automation, and antivirus

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The package contains a shared, hard-coded Telegram bot control channel. After explicit `/tg` activation and authorization, bot messages invoke CLI print mode; its output is sent back to Telegram. Print mode bypasses the CLI's interactive approval checks for file-write and shell tools.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs `/tg` or launches `stella-cli/tg-server.mjs`, authorizes a Telegram account, then sends a bot message.

Impact

A holder of the embedded bot credential can operate the shared bot channel; authorized remote messages can cause local agent actions and return resulting local data to Telegram.

Mechanism

Hard-coded Telegram C2-style channel relays auto-approved AI-agent actions and output.

Attack narrative

The package embeds a Telegram bot credential rather than requiring a user-owned bot. Its Telegram handler accepts authorized messages, runs the CLI with `-p`, and sends up to 4,000 characters of result back to Telegram. `-p` disables interactive permission prompts, while the tool set includes shell execution and filesystem writes. This forms a concrete remote control and output-exfiltration path through a bot credential controlled outside the installing user's account, despite requiring explicit feature activation rather than an npm lifecycle hook.

Rationale

Direct source inspection confirms a hard-coded external Telegram control/output channel combined with permission-bypassing prompt mode and powerful local tools. The absence of install-time execution lowers stealth, but does not remove the concrete malicious remote-control and data-relay capability.

Evidence

package.jsonstella-cli/telegram-bot.mjsstella-cli/index.mjsstella-cli/tools.mjsstella-cli/tg-server.mjsstella-cli/tg-server.batstella-cli/tg-bg.bat

Network endpoints2

api.telegram.org/bot${BOT_TOKEN}opencode.ai/zen/v1

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

Evidence for block

`stella-cli/telegram-bot.mjs` embeds a Telegram bot token and uses `api.telegram.org`.
`telegram-bot.mjs` polls Telegram, executes `index.mjs -p` for authenticated messages, then relays output.
`index.mjs` makes `-p` mode auto-approve tool permissions.
`tools.mjs` exposes filesystem writes and shell execution; output can return to Telegram.
`stella-cli/tg-server.bat` restarts the bot indefinitely when explicitly launched.

Evidence against

`package.json` declares no preinstall/install/postinstall lifecycle hook.
Telegram control requires explicit `/tg` activation and an authorization-code flow.
No source confirms autonomous credential-file harvesting or stealth agent-config mutation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 43 file(s), 1.10 MB of source, external domains: 127.0.0.1, accounts.google.com, api-maps.yandex.ru, api.duckduckgo.com, api.github.com, api.telegram.org, cdn.jsdelivr.net, console.cloud.google.com, discord.gg, fonts.googleapis.com, geocode-maps.yandex.ru, github.com, gitlab.com, gmail.googleapis.com, html.duckduckgo.com, oauth2.googleapis.com, ollama.com, opencode.ai, static-maps.yandex.ru, www.google.com, www.googleapis.com, www.kinopoisk.ru, www.virustotal.com, www.w3.org, www.youtube.com

Source & flagged code

15 flagged

dist/security.mjsView file

Lines 1-24javascript

1import crypto from "node:crypto"

2import fs from "node:fs"

3import path from "node:path"

4import os from "node:os"

5import { execSync } from "node:child_process"

6import { fileURLToPath } from "node:url"

High

Child Process

Package source references child process execution.

dist/security.mjsView on unpkg · L4

8const __filename = fileURLToPath(import.meta.url)

9const __dirname = path.dirname(__filename)

11const STELLA_HIDDEN = path.join(os.homedir(), ".stella", ".secure")

12const KEY_FILE = path.join(STELLA_HIDDEN, "vault.dat")

13const FINGERPRINT_FILE = path.join(STELLA_HIDDEN, ".fp")

14const INTEGRITY_FILE = path.join(STELLA_HIDDEN, ".integrity")

15const LOCKOUT_FILE = path.join(STELLA_HIDDEN, ".lockout")

17const CLI_FILES = [

18 "stella-cli/index.mjs",

19 "stella-cli/tools.mjs",

20 "stella-cli/banner.mjs",

21 "stella-cli/theme.mjs",

22 "stella-cli/markdown.mjs",

23 "stella-cli/security.mjs",

24]

dist/antimalware/scanner.mjsView file

Lines 316-356javascript

316// ═══════════════════════════════════════════════════════════════

317

318export function scanRunningProcesses() {

319 const results = []

320

321 // Known safe Windows processes

322 const SAFE_PROCESSES = new Set

dist/antimalware/database.mjsView file

Lines 145-185javascript

145 // ══════ EXPLOITS ══════

146 { id: "SIG-031", name: "Metasploit стейджинг", severity: "critical", category: "exploit",

147 pattern: /msfvenom[\s\S]{0,100}reverse[\s\S]{0,50}(tcp|http|https)[\s\S]{0,100}

dist/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Stella Coder 3.9 — терминальный AI-агент

3import readline from "node:readline"

4import fs from "node:fs"

5import path from "node:path"

6import os from "node:os"

7import { execSync } from "node:child_process"

stella-cli/telegram-bot.mjsView file

Lines 1-24javascript

1import fs from "node:fs"

2import path from "node:path"

3import os from "node:os"

4import crypto from "node:crypto"

5import { execSync } from "node:child_process"

7// ═══════════════════════════════════════════════════════════════════

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 57424 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 57424 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

antimalware/database.mjsView file

•matchType = normalized_sha256 matchedPackage = stella-coder@5.2.1 matchedPath = antimalware/database.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

antimalware/database.mjsView on unpkg

dist/tools.mjsView file

•matchType = normalized_sha256 matchedPackage = stella-coder@5.2.1 matchedPath = dist/tools.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools.mjsView on unpkg

stella-cli/build.mjsView file

•matchType = normalized_sha256 matchedPackage = stella-coder@5.2.1 matchedPath = stella-cli/build.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

stella-cli/build.mjsView on unpkg

Source & flagged code

15 flagged · loading source

dist/security.mjsView file

4import os from "node:os" L5: import { execSync } from "node:child_process" L6: import { fileURLToPath } from "node:url"

High

Child Process

Package source references child process execution.

dist/security.mjsView on unpkg · L4

dist/antimalware/scanner.mjsView file

336"ollama.exe", "ollama_llama_server.exe", L337: "powershell.exe", "pwsh.exe", "cmd.exe", L338: "WindowsTerminal.exe", "wt.exe",

High

Shell

Package source references shell execution.

dist/antimalware/scanner.mjsView on unpkg · L336

dist/antimalware/database.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/antimalware/database.mjsView on unpkg

165{ id: "SIG-037", name: "Service install", severity: "high", category: "privesc", L166: pattern: /CreateService[\s\S]{0,100}(SERVICE_AUTO_START|SERVICE_WIN32_OWN_PROCESS)[\s\S]{0,100}(cmd|powershell|bash)/ }, L167: ... L188: { id: "SIG-044", name: "Scheduled task", severity: "high", category: "persistence", L189: pattern: /schtasks[\s\S]{0,100}(\/create|\/Create)[\s\S]{0,100}(cmd|powershell|bash|python|perl)/ }, L190: ... L207: { id: "SIG-050", name: "DNS tunneling", severity: "high", category: "backdoor", L208: pattern: /DnsQuery[\s\S]{0,100}(TXT|MX|CNAME)[\s\S]{0,100}(encode|decode|base64)[\s\S]{0,100}(socket|connect)/ }, L209: ... L240: { id: "SIG-060", name: "HTTP POST exfil", severity: "high", category: "exfil", L241: pattern: /(fetch|XMLHttpRequest|axios|http\.request|request\()[\s\S]{0,200}(POST|PUT)[\s\S]{0,200}(password|token|secret|credential|cookie)/ }, L242:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/antimalware/database.mjsView on unpkg · L165

dist/index.mjsView file

6Cross-file remote execution chain: dist/index.mjs spawns dist/tools.mjs; helper contains network access plus dynamic code execution. L6: import os from "node:os" L7: import { execSync } from "node:child_process" L8: import { streamText, stepCountIs, generateText } from "ai" ... L22: const VERSION = "3.9.2" L23: const CONFIG_DIR = path.join(os.homedir(), ".stella") L24: const CONFIG_PATH = path.join(CONFIG_DIR, "config.json") ... L26: L27: const ZEN_BASE_URL = "https://opencode.ai/zen/v1" L28: ... L53: function loadConfig() { L54: try { return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8")) } catch { return {} } L55: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.mjsView on unpkg · L6

1371try { L1372: const { execSync } = await import("node:child_process") L1373: execSync(lintCmd, { encoding: "utf8", stdio: "inherit" }) ... L1379: case "/format": { L1380: const formatCmd = arg || "npx prettier --write ." L1381: console.log(dim(`\n Форматирую: ${formatCmd}\n`))

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L1371

•matchType = normalized_sha256 matchedPackage = stella-coder@5.2.1 matchedPath = dist/index.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

6import os from "node:os" L7: import { execSync } from "node:child_process" L8: import { streamText, stepCountIs, generateText } from "ai" ... L22: const VERSION = "3.9.2" L23: const CONFIG_DIR = path.join(os.homedir(), ".stella") L24: const CONFIG_PATH = path.join(CONFIG_DIR, "config.json") ... L26: L27: const ZEN_BASE_URL = "https://opencode.ai/zen/v1" L28: ... L53: function loadConfig() { L54: try { return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8")) } catch { return {} } L55: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.mjsView on unpkg · L6

stella-cli/telegram-bot.mjsView file

4import crypto from "node:crypto" L5: import { execSync } from "node:child_process" L6: ... L11: const BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0" L12: const API_URL = `https://api.telegram.org/bot${BOT_TOKEN}` L13: const PREMIUM_CODE = "10102013" ... L15: L16: const CONFIG_DIR = path.join(os.homedir(), ".stella") L17: const BOT_CONFIG_PATH = path.join(CONFIG_DIR, "telegram-bot.json") ... L29: headers: { "Content-Type": "application/json" }, L30: body: JSON.stringify(body), L31: signal: AbortSignal.timeout(30000),

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

stella-cli/telegram-bot.mjsView on unpkg · L4

4Trigger-reachable chain: manifest.main -> stella-cli/index.mjs -> stella-cli/telegram-bot.mjs L4: import crypto from "node:crypto" L5: import { execSync } from "node:child_process" L6: ... L11: const BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0" L12: const API_URL = `https://api.telegram.org/bot${BOT_TOKEN}` L13: const PREMIUM_CODE = "10102013" ... L15: L16: const CONFIG_DIR = path.join(os.homedir(), ".stella") L17: const BOT_CONFIG_PATH = path.join(CONFIG_DIR, "telegram-bot.json") ... L29: headers: { "Content-Type": "application/json" }, L30: body: JSON.stringify(body), L31: signal: AbortSignal.timeout(30000),

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

stella-cli/telegram-bot.mjsView on unpkg · L4

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 57424 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 57424 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

antimalware/database.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

antimalware/database.mjsView on unpkg

dist/tools.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools.mjsView on unpkg

stella-cli/build.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

stella-cli/build.mjsView on unpkg

Findings

2 Critical10 High5 Medium5 Low

CriticalCredential Exfiltrationstella-cli/telegram-bot.mjs

CriticalTrigger Reachable Dangerous Capabilitystella-cli/telegram-bot.mjs

HighChild Processdist/security.mjs

HighShelldist/antimalware/scanner.mjs

HighCross File Remote Execution Contextdist/index.mjs

HighRuntime Package Installdist/index.mjs

HighPayload In Excluded Dir.opencode/skills/ui-ux-pro-max/scripts/design_system.py

HighKnown Malware Source Similarityantimalware/database.mjs

HighKnown Malware Source Similaritydist/antimalware/database.mjs

HighKnown Malware Source Similaritydist/index.mjs

HighKnown Malware Source Similaritydist/tools.mjs

HighKnown Malware Source Similaritystella-cli/build.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.mjs

MediumShips Build Helper.opencode/skills/ui-ux-pro-max/scripts/design_system.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/antimalware/database.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

15 flagged

dist/security.mjsView file

Lines 1-24javascript

1import crypto from "node:crypto"

2import fs from "node:fs"

3import path from "node:path"

4import os from "node:os"

5import { execSync } from "node:child_process"

6import { fileURLToPath } from "node:url"

High

Child Process

Package source references child process execution.

dist/security.mjsView on unpkg · L4

8const __filename = fileURLToPath(import.meta.url)

9const __dirname = path.dirname(__filename)

11const STELLA_HIDDEN = path.join(os.homedir(), ".stella", ".secure")

12const KEY_FILE = path.join(STELLA_HIDDEN, "vault.dat")

13const FINGERPRINT_FILE = path.join(STELLA_HIDDEN, ".fp")

14const INTEGRITY_FILE = path.join(STELLA_HIDDEN, ".integrity")

15const LOCKOUT_FILE = path.join(STELLA_HIDDEN, ".lockout")

17const CLI_FILES = [

18 "stella-cli/index.mjs",

19 "stella-cli/tools.mjs",

20 "stella-cli/banner.mjs",

21 "stella-cli/theme.mjs",

22 "stella-cli/markdown.mjs",

23 "stella-cli/security.mjs",

24]

dist/antimalware/scanner.mjsView file

Lines 316-356javascript

316// ═══════════════════════════════════════════════════════════════

317

318export function scanRunningProcesses() {

319 const results = []

320

321 // Known safe Windows processes

322 const SAFE_PROCESSES = new Set

dist/antimalware/database.mjsView file

Lines 145-185javascript

145 // ══════ EXPLOITS ══════

146 { id: "SIG-031", name: "Metasploit стейджинг", severity: "critical", category: "exploit",

147 pattern: /msfvenom[\s\S]{0,100}reverse[\s\S]{0,50}(tcp|http|https)[\s\S]{0,100}

dist/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Stella Coder 3.9 — терминальный AI-агент

3import readline from "node:readline"

4import fs from "node:fs"

5import path from "node:path"

6import os from "node:os"

7import { execSync } from "node:child_process"

stella-cli/telegram-bot.mjsView file

Lines 1-24javascript

1import fs from "node:fs"

2import path from "node:path"

3import os from "node:os"

4import crypto from "node:crypto"

5import { execSync } from "node:child_process"

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 57424 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 57424 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

antimalware/database.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

antimalware/database.mjsView on unpkg

dist/tools.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools.mjsView on unpkg

stella-cli/build.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

stella-cli/build.mjsView on unpkg