Suspicious ^80% lua Download

copilot-sdk-supercharged 2.0.2-1

Impersonates official GitHub Copilot SDK

Lua shellcode generatorBase64 decoding

SHA-256c82ffdddaffbaac4b1d69a7ef9977bc8a59dc852bf13db721dfc26ff30ef4940

URLhttps://luarocks.org/copilot-sdk-supercharged-2.0.2-1.src.rock

MaleculeO₁₀(As₂C₉CaEr₂Eu₃IPPrS₆Xe₆)H₅(Cm₂₇Db₈F₁₂Os₁₀Po₂₀)Md₄(Bk₂Pa₁₁Pt₂)

Evidence

Lua environment variable access lines 34–37

  -- Resolve options with defaults
  self._cli_path       = options.cliPath or os.getenv("COPILOT_CLI_PATH") or "copilot"
  self._cwd            = options.cwd
  self._log_level      = options.logLevel or "info"

Lua io.popen text lines 112–114

  -- Open the process with bidirectional stdio via io.popen
  -- Lua 5.1/5.2 io.popen only gives one direction. We need a workaround.
  -- Strategy: use a pair of popen calls or the luaposix / LuaSocket approach.

Executes system commands lines 479–486

  -- Create a FIFO for writing to the process's stdin
  local fifo_path = os.tmpname() .. "_copilot_fifo"
  local mkfifo_ok = os.execute("mkfifo " .. fifo_path .. " 2>/dev/null")
  if not mkfifo_ok then
      -- Fallback: use /tmp path
      fifo_path = "/tmp/copilot_sdk_fifo_" .. tostring(os.time()) .. "_" .. tostring(math.random(100000))
      os.execute("mkfifo " .. fifo_path)
  end

Lua opens file in write mode lines 496–500

  -- Open the FIFO for writing (this will block until the reader is connected,
  -- which happens when the process starts reading from stdin)
  local stdin_handle = io.open(fifo_path, "w")
  if not stdin_handle then
      stdout_handle:close()

Lua shellcode generator lines 513–517

513-- that is piped to the process stdin.
514function CopilotClient:_spawn_process_windows(cmd)
515    -- On Windows, use a simpler approach with named pipes via cmd.exe
516    -- We create a background process and communicate via temp files.
517    -- For a production SDK, one would use luaposix or a C extension.

Showing the top 5 files — 7 more files (82 regions) not shown.

No evidence locations were recorded for this file. Raw result