Loading npm security reports…

zcode-acp-server@0.32.0: Malicious npm security report (Block) | LPM Firewall

registry / zcode-acp-server / 0.32.0

zcode-acp-server@0.32.0

Agent Client Protocol (ACP) server bridging headless ZCode to editors like Zed and JetBrains.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The package automatically runs a postinstall notifier and contains runtime code that escapes a macOS Seatbelt sandbox through a LaunchAgent. The escape relaunches a hub as an unsandboxed user process with the inherited environment.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installation runs the notifier; later, a macOS hub started with ZCODE_ACP_SANDBOX_ACTIVE invokes the relaunch path.

Impact

A constrained agent process can be replaced by an unsandboxed, persistent user-domain process that inherits its environment.

Mechanism

LaunchAgent-based sandbox escape and process persistence.

Attack narrative

After installation, the package contacts a local hub when a configured token exists. Its more serious runtime path detects a macOS sandbox marker, writes a LaunchAgent plist containing inherited environment values, bootstraps it into the user GUI domain, and kickstarts it. This deliberately moves the hub outside the originating Seatbelt sandbox and leaves a launchd-managed process path.

AI rationale

The source implements a deliberate sandbox escape through launchd and is paired with an automatic install hook. Token gating limits exposure but does not neutralize the permission-bypass behavior.

Evidence

package.jsondist/remote/hub-upgrade-notify.jsdist/remote/hub-sandbox.js

Network endpoints1

127.0.0.1

Decision evidence

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/remote/hub-upgrade-notify.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/remote/hub-upgrade-notify.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/runtime.jsView file

17*/ L18: import { spawn, execFileSync } from "node:child_process"; L19: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/runtime.jsView on unpkg · L17

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/runtime.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime.jsView on unpkg

dist/remote/hub-sandbox.jsView file

14Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/bin/hub.js -> dist/remote/hub-sandbox.js L14: */ L15: import { execFileSync } from "node:child_process"; L16: import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L29: /** Whether this process was born inside our Seatbelt wrap. */ L30: export function sandboxBorn(env = process.env) { L31: return process.platform === "darwin" && (env[SANDBOX_ACTIVE_ENV] ?? "").trim() !== ""; L32: } ... L41: /** L42: * The LaunchAgent plist body: run the hub entry under this node, with THIS L43: * process's env minus the birth marker (so the relaunched hub does not ... L122: try { L123: execFileSync("launchctl", ["bootstrap", domain, plistPath], { stdio: "ignore" });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/remote/hub-sandbox.jsView on unpkg · L14

14*/ L15: import { execFileSync } from "node:child_process"; L16: import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L29: /** Whether this process was born inside our Seatbelt wrap. */ L30: export function sandboxBorn(env = process.env) { L31: return process.platform === "darwin" && (env[SANDBOX_ACTIVE_ENV] ?? "").trim() !== ""; L32: } ... L41: /** L42: * The LaunchAgent plist body: run the hub entry under this node, with THIS L43: * process's env minus the birth marker (so the relaunched hub does not ... L122: try { L123: execFileSync("launchctl", ["bootstrap", domain, plistPath], { stdio: "ignore" });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/remote/hub-sandbox.jsView on unpkg · L14

dist/remote/endpoint.js#virtual:normalized:round1View file

182// bridge"s lifetime follows the stdio editor, not remote clients).\n httpServer.unref();\n httpServer.on(\"error\", (e) => warn(`remote: endpoint error: ${e.message}`));\n ... L183: // could claim another"s bridge. Bridges started by hand carry none.\n ...(process.env.ZCODE_ACP_SPAWN_NONCE ? { nonce: process.env.ZCODE_ACP_SPAWN_NONCE } : {}),\n /... L184: // hub-spawn catch below (which would misread it as "hub unreachable"). ... L193: try { L194: const res = await postJson(`http://127.0.0.1:${config.hubPort}/api/register`, payload(lastSessions)); L195: if (res.status === 401) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/remote/endpoint.js#virtual:normalized:round1View on unpkg · L182

dist/backend/client.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/backend/client.js#virtual:normalized:round1View on unpkg

dist/tui.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/tui.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tui.jsView on unpkg

dist/backend/client.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/backend/client.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend/client.jsView on unpkg

dist/backend/sandbox.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/backend/sandbox.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/backend/sandbox.jsView on unpkg

dist/remote/endpoint.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/remote/endpoint.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/remote/endpoint.jsView on unpkg

dist/bin/hub.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/bin/hub.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/hub.jsView on unpkg

dist/i18n.jsView file

•matchType = token_shingles matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/i18n.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/i18n.jsView on unpkg

dist/utils.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/utils.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils.jsView on unpkg

dist/handlers/extensions.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/handlers/extensions.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/extensions.jsView on unpkg

dist/handlers/slash.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/handlers/slash.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/slash.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = zcode-acp-server@0.37.0 matchedPath = dist/index.js matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

dist/remote/hub-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = zcode-acp-server@0.37.1 matchedIdentity = npm:emNvZGUtYWNwLXNlcnZlcg:0.37.1 similarity = 0.722 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/remote/hub-server.jsView on unpkg